Menu
Critical VPN key exchange flaw exposes Cisco security appliances to remote hacking

Critical VPN key exchange flaw exposes Cisco security appliances to remote hacking

Firewalls running Cisco Adaptive Security Appliance (ASA) software can be compromised remotely with malformed UDP packets

Cisco Systems patched a critical vulnerability that could allow remote attackers to take over Cisco Adaptive Security Appliance (ASA) firewalls configured as virtual private network servers by simply sending malformed network packets to them.

For devices that are designed to protect private networks from Internet attacks, this is as bad as it gets. That's why Cisco rated the vulnerability with the maximum score of 10 in the Common Vulnerability Scoring System.

The flaw is located in the Cisco ASA code that handles the Internet Key Exchange version 1 (IKEv1) and IKE version 2 (IKEv2) protocols. More precisely, it stems from a buffer overflow condition in the function that processes fragmented IKE payloads.

"An attacker could exploit this vulnerability by sending crafted UDP packets to the affected system," Cisco said in an advisory. "An exploit could allow the attacker to execute arbitrary code and obtain full control of the system or to cause a reload of the affected system."

IKE is used as a key exchange mechanism in IPsec-based virtual private networks (VPNs). As such, the Cisco ASA devices are only vulnerable if they are configured to act as termination points for LAN-to-LAN IPsec VPN, remote access VPN using the IPsec VPN client, Layer 2 Tunneling Protocol (L2TP)-over-IPsec VPN connections and IKEv2 AnyConnect.

Cisco ASA products are frequently configured for VPN. Their strength is that they can provide IP routing, firewall, network antivirus, intrusion prevention and VPN functionality in a single device.

According to Cisco the following products are vulnerable: Cisco ASA 5500 Series Adaptive Security Appliances, Cisco ASA 5500-X Series Next-Generation Firewalls, Cisco ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers, Cisco ASA 1000V Cloud Firewall, Cisco Adaptive Security Virtual Appliance (ASAv), Cisco Firepower 9300 ASA Security Module and Cisco ISA 3000 Industrial Security Appliance.

The Cisco advisory contains a list with the fixed Cisco ASA software versions for different release branches. Users are advised to update as soon as possible.

The Internet Storm Center at the SANS Technology Institute has reported seeing a large increase in Internet probes on UDP port 500, which is the most likely port number for exploiting this vulnerability.


Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Featured

Slideshows

Sizing up the NZ security spectrum - Where's the channel sweet spot?

Sizing up the NZ security spectrum - Where's the channel sweet spot?

From new extortion schemes, outside threats and rising cyber attacks, the art of securing the enterprise has seldom been so complex or challenging. With distance no longer a viable defence, Kiwi businesses are fighting to stay ahead of the security curve. In total, 28 per cent of local businesses faced a cyber attack last year, with the number in New Zealand set to rise in 2017. Yet amidst the sensationalism, media headlines and ongoing high profile breaches, confusion floods the channel, as partners seek strategic methods to combat rising sophistication from attackers. In sizing up the security spectrum, this Reseller News roundtable - in association with F5 Networks, Kaspersky Lab, Tech Data, Sophos and SonicWall - assessed where the channel sweet spot is within the New Zealand channel. Photos by Maria Stefina.

Sizing up the NZ security spectrum - Where's the channel sweet spot?
Kiwi channel comes together for another round of After Hours

Kiwi channel comes together for another round of After Hours

The channel came together for another round of After Hours, with a bumper crowd of distributors, vendors and partners descending on The Jefferson in Auckland. Photos by Maria Stefina.​

Kiwi channel comes together for another round of After Hours
Consegna comes to town with AWS cloud offerings launch in Auckland

Consegna comes to town with AWS cloud offerings launch in Auckland

Emerging start-up Consegna has officially launched its cloud offerings in the New Zealand market, through a kick-off event held at Seafarers Building in Auckland.​ Founded in June 2016, the Auckland-based business is backed by AWS and supported by a global team of cloud specialists, leveraging global managed services partnerships with Rackspace locally.

Consegna comes to town with AWS cloud offerings launch in Auckland
Show Comments