Cisco ASA Exploited in the Wild; FXOS, NX-OS Get High-Priority Patches
Cisco released a high-severity patch update for CVE-2018-0296 on June 22 which affects the Adaptive Security Appliance (ASA). There’s no time to waste in deploying this patch, as the company’s advisory notes it is currently being exploited in the wild.
The ASA patch, which addresses the lack of proper input validation of the HTTP URL, is the latest in a long list of updates from Cisco this month. A slew of patches were issued June 6, followed by a whopping 34 patches on June 20, including five critical and 19 high-severity patches for its Firepower firewalls (FXOS) and Nexus switches (NX-OS). Another 10 medium-severity fixes also were issued this month for a variety of other Cisco systems.
The five critical vulnerabilities all scored a 9.8 CVSS v3 rating. Four of these addressed flaws with packet header processing. The fifth, CVE-2018-0301, affects Cisco’s NX-OS Software NX-API.
Analysis
ASA (CVE-2018-0296)
This issue could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. Cisco states certain ASA software may not trigger a device reload, however an attacker could view sensitive system information without authentication by using directory traversal techniques. As of June 22, 2018, this issue has been seen being exploited in the wild and a Python directory traversal exploit was available on GitHub.
NX-OS / FXOS / NX-API (CVE-2018-0304, CVE-2018-0308, CVE-2018-0312, CVE-2018-0314, CVE-2018-0301)
According to Cisco, the first four critical CVEs all address a similar issue in Cisco Fabric Services. An unauthenticated, remote attacker could send a maliciously crafted Cisco Fabric Services packet to read protected memory, trigger a denial of service, or execute arbitrary code, leading to full system compromise.
As for the the fifth CVE, Cisco states: “The vulnerability is due to incorrect input validation in the authentication module of the NX-API subsystem. An attacker could exploit this vulnerability by sending a crafted HTTP or HTTPS packet to the management interface of an affected system with the NX-API feature enabled. An exploit could allow the attacker to execute arbitrary code as root.” According to the advisory, an attacker would require access to of one of the following enabled virtual port distribution channels (vPCs): CFSoFC, CFSoE, or CFSoIP. (Note: Only CFSoFC is enabled by default.)
Solution
Cisco has released patches for all listed CVE’s for the products affected at this time and advises customers to update immediately. Tenable is continuously monitoring to provide the necessary plugins to assist our clients.
Tenable® has released the following plugins to help our customers determine their Cyber Exposure gap.
|
Plugin ID |
Description |
|
Cisco ASA Multiple Vulnerabilities (cisco-sa-20180606-asaftd) |
|
|
Cisco NX-OS Cisco Fabric Services Multiple Vulnerabilities. |
|
|
Cisco NX-OS NXAPI Multiple Vulnerabilities. |
Additional Information
- Cisco Advisory
- Learn more about Tenable.io, the first Cyber Exposure platform for holistic management of your modern attack surface
- Get a free 60-day trial of Tenable.io Vulnerability Management
Related Articles
Cybersecurity Snapshot: CISA Hands Down Cloud Security Directive, While Threat from North Korean IT Workers Gets the Spotlight
December 20, 2024Check out the new cloud security requirements for federal agencies. Plus, beware of North Korean government operatives posing as remote IT pros. Also, learn how water plants can protect their HMIs against cyberattacks. And get the latest on the U.S. cyber incident response framework; the CIS Benchmarks; and local and state governments’ cyber challenges.
Web App Scanning 101: What Security Pros Need to Know About CI/CD Pipelines
December 19, 2024Git, repositories and pipelines…oh my! We unpack standard practices in the web app development process and provide guidance on how to use Tenable Web Application Scanning to secure your code.
Cybersecurity Snapshot: Telecoms May Face Tougher Regulations After Salt Typhoon Hacks, as Study Finds Cyber Pros More Stressed at Work
December 13, 2024The FCC wants stronger cyber regulations for telecoms after cyber espionage breaches. Meanwhile, find out why cyber pros say work has become more difficult. Plus, check out tips to prevent AI-boosted financial fraud. And get the latest on vulnerability management, EU cyber challenges and CIS predictions for 2025.