Menu
Critical VPN key exchange flaw exposes Cisco security appliances to remote hacking

Critical VPN key exchange flaw exposes Cisco security appliances to remote hacking

Firewalls running Cisco Adaptive Security Appliance (ASA) software can be compromised remotely with malformed UDP packets

Cisco Systems patched a critical vulnerability that could allow remote attackers to take over Cisco Adaptive Security Appliance (ASA) firewalls configured as virtual private network servers by simply sending malformed network packets to them.

For devices that are designed to protect private networks from Internet attacks, this is as bad as it gets. That's why Cisco rated the vulnerability with the maximum score of 10 in the Common Vulnerability Scoring System.

The flaw is located in the Cisco ASA code that handles the Internet Key Exchange version 1 (IKEv1) and IKE version 2 (IKEv2) protocols. More precisely, it stems from a buffer overflow condition in the function that processes fragmented IKE payloads.

"An attacker could exploit this vulnerability by sending crafted UDP packets to the affected system," Cisco said in an advisory. "An exploit could allow the attacker to execute arbitrary code and obtain full control of the system or to cause a reload of the affected system."

IKE is used as a key exchange mechanism in IPsec-based virtual private networks (VPNs). As such, the Cisco ASA devices are only vulnerable if they are configured to act as termination points for LAN-to-LAN IPsec VPN, remote access VPN using the IPsec VPN client, Layer 2 Tunneling Protocol (L2TP)-over-IPsec VPN connections and IKEv2 AnyConnect.

Cisco ASA products are frequently configured for VPN. Their strength is that they can provide IP routing, firewall, network antivirus, intrusion prevention and VPN functionality in a single device.

According to Cisco the following products are vulnerable: Cisco ASA 5500 Series Adaptive Security Appliances, Cisco ASA 5500-X Series Next-Generation Firewalls, Cisco ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers, Cisco ASA 1000V Cloud Firewall, Cisco Adaptive Security Virtual Appliance (ASAv), Cisco Firepower 9300 ASA Security Module and Cisco ISA 3000 Industrial Security Appliance.

The Cisco advisory contains a list with the fixed Cisco ASA software versions for different release branches. Users are advised to update as soon as possible.

The Internet Storm Center at the SANS Technology Institute has reported seeing a large increase in Internet probes on UDP port 500, which is the most likely port number for exploiting this vulnerability.

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Slideshows

IN PICTURES: Ingram Micro Innovation hits Auckland with Hewlett Packard Enterprise

IN PICTURES: Ingram Micro Innovation hits Auckland with Hewlett Packard Enterprise

Ingram Micro completed its nationwide roadshow in Auckland last month, kicking off its Innovation Hour series with Hewlett Packard Enterprise. Uncovering the latest in storage, networking and servers, the event outlined key market trends for resellers in 2016 and beyond.

IN PICTURES: Ingram Micro Innovation hits Auckland with Hewlett Packard Enterprise
IN PICTURES: FireEye celebrates channel at 2016 Partner Conference

IN PICTURES: FireEye celebrates channel at 2016 Partner Conference

FireEye welcomed 143 channel partners and distributors to FireEye's 2016 annual Partner Conference, FireEye A/NZ Momentum - held at Establishment in Sydney. Delegates heard from senior trans-Tasman channel leaders, marketing and the product divisions in the morning, with FireEye customers, incident responders and threat intelligence analysts sharing knowledge during the afternoon.

IN PICTURES: FireEye celebrates channel at 2016 Partner Conference
Show Comments