Cisco ASA - WebVPN Security Vulnerability

Cisco has issued a critical security advisory that affects Cisco Adaptive Security Appliances (ASA). To be vulnerable the, ASA must have Secure Socket Layer (SSL) services or IKEv2 Remote Access VPN services enabled on an interface. A list of affected devices and software versions in listed below. The vulnerability could allow an attacker to take control of your Cisco ASA device and there is no workaround available. This vulnerability only affects devices that the have the webVPN feature enabled, but Hostway recommends that all affected devices be patched as soon as possible. Please contact Hostway Support to schedule the patch of the device.

 

Detailed vulnerability information:

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180129-asa1

 
A vulnerability in the Secure Sockets Layer (SSL) VPN functionality of the Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to cause a reload of the affected system or to remotely execute code. The vulnerability is due to an attempt to double free a region of memory when the webvpn feature is enabled on the Cisco ASA device. An attacker could exploit this vulnerability by sending multiple, crafted XML packets to a webvpn-configured interface on the affected system. An exploit could allow the attacker to execute arbitrary code and obtain full control of the system, or cause a reload of the affected device. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180129-asa1

 

 

Affected devices:Cisco Firepower Threat Defense Software (FTD) 0
Cisco FirePOWER 9300 ASA Security Module 0
Cisco Firepower 4110 Security Appliance 0
Cisco Firepower 2100 Series Security Appliance 0
Cisco ASA Software 9.5
Cisco ASA Software 9.3
Cisco ASA Software 9.0
Cisco ASA Services Module for Cisco Catalyst 6500 Series Switches 0
Cisco ASA Services Module for Cisco 7600 Series Routers 0
Cisco ASA 5500-X Series Next-Generation Firewalls 0
Cisco ASA 5500-X Series Firewalls 9.8(1)
Cisco ASA 5500-X Series Firewalls 9.6(2)
Cisco ASA 5500-X Series Firewalls 9.2(4)
Cisco ASA 5500 Series Adaptive Security Appliances 0
Cisco Asa 1000V Cloud Firewall 0
Cisco Adaptive Security Virtual Appliance (ASAv) 0
Cisco Adaptive Security Appliance (ASA) Software 9.6.3.20
Cisco Adaptive Security Appliance (ASA) Software 9.4.4.14
Cisco Adaptive Security Appliance (ASA) Software 9.1.7.20
Cisco Adaptive Security Appliance (ASA) Software 8.x
Cisco 3000 Series Industrial Security Appliance (ISA) 0