Cisco Systems patched a critical vulnerability that could allow remote attackers to take over Cisco Adaptive Security Appliance (ASA) firewalls configured as virtual private network servers by simply sending malformed network packets to them.
For devices that are designed to protect private networks from Internet attacks, this is as bad as it gets. That’s why Cisco rated the vulnerability with the maximum score of 10 in the Common Vulnerability Scoring System.
The flaw is located in the Cisco ASA code that handles the Internet Key Exchange version 1 (IKEv1) and IKE version 2 (IKEv2) protocols. More precisely, it stems from a buffer overflow condition in the function that processes fragmented IKE payloads.
“An attacker could exploit this vulnerability by sending crafted UDP packets to the affected system,” Cisco said in an advisory. “An exploit could allow the attacker to execute arbitrary code and obtain full control of the system or to cause a reload of the affected system.”
IKE is used as a key exchange mechanism in IPsec-based virtual private networks (VPNs). As such, the Cisco ASA devices are only vulnerable if they are configured to act as termination points for LAN-to-LAN IPsec VPN, remote access VPN using the IPsec VPN client, Layer 2 Tunneling Protocol (L2TP)-over-IPsec VPN connections and IKEv2 AnyConnect.
Cisco ASA products are frequently configured for VPN. Their strength is that they can provide IP routing, firewall, network antivirus, intrusion prevention and VPN functionality in a single device.
According to Cisco the following products are vulnerable: Cisco ASA 5500 Series Adaptive Security Appliances, Cisco ASA 5500-X Series Next-Generation Firewalls, Cisco ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers, Cisco ASA 1000V Cloud Firewall, Cisco Adaptive Security Virtual Appliance (ASAv), Cisco Firepower 9300 ASA Security Module and Cisco ISA 3000 Industrial Security Appliance.
The Cisco advisory contains a list with the fixed Cisco ASA software versions for different release branches. Users are advised to update as soon as possible.
The Internet Storm Center at the SANS Technology Institute has reported seeing a large increase in Internet probes on UDP port 500, which is the most likely port number for exploiting this vulnerability.