Cisco ASA Exploited in the Wild; FXOS, NX-OS Get High-Priority Patches
Cisco released a high-severity patch update for CVE-2018-0296 on June 22 which affects the Adaptive Security Appliance (ASA). There’s no time to waste in deploying this patch, as the company’s advisory notes it is currently being exploited in the wild.
The ASA patch, which addresses the lack of proper input validation of the HTTP URL, is the latest in a long list of updates from Cisco this month. A slew of patches were issued June 6, followed by a whopping 34 patches on June 20, including five critical and 19 high-severity patches for its Firepower firewalls (FXOS) and Nexus switches (NX-OS). Another 10 medium-severity fixes also were issued this month for a variety of other Cisco systems.
The five critical vulnerabilities all scored a 9.8 CVSS v3 rating. Four of these addressed flaws with packet header processing. The fifth, CVE-2018-0301, affects Cisco’s NX-OS Software NX-API.
Analysis
ASA (CVE-2018-0296)
This issue could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. Cisco states certain ASA software may not trigger a device reload, however an attacker could view sensitive system information without authentication by using directory traversal techniques. As of June 22, 2018, this issue has been seen being exploited in the wild and a Python directory traversal exploit was available on GitHub.
NX-OS / FXOS / NX-API (CVE-2018-0304, CVE-2018-0308, CVE-2018-0312, CVE-2018-0314, CVE-2018-0301)
According to Cisco, the first four critical CVEs all address a similar issue in Cisco Fabric Services. An unauthenticated, remote attacker could send a maliciously crafted Cisco Fabric Services packet to read protected memory, trigger a denial of service, or execute arbitrary code, leading to full system compromise.
As for the the fifth CVE, Cisco states: “The vulnerability is due to incorrect input validation in the authentication module of the NX-API subsystem. An attacker could exploit this vulnerability by sending a crafted HTTP or HTTPS packet to the management interface of an affected system with the NX-API feature enabled. An exploit could allow the attacker to execute arbitrary code as root.” According to the advisory, an attacker would require access to of one of the following enabled virtual port distribution channels (vPCs): CFSoFC, CFSoE, or CFSoIP. (Note: Only CFSoFC is enabled by default.)
Solution
Cisco has released patches for all listed CVE’s for the products affected at this time and advises customers to update immediately. Tenable is continuously monitoring to provide the necessary plugins to assist our clients.
Tenable® has released the following plugins to help our customers determine their Cyber Exposure gap.
|
Plugin ID |
Description |
|
Cisco ASA Multiple Vulnerabilities (cisco-sa-20180606-asaftd) |
|
|
Cisco NX-OS Cisco Fabric Services Multiple Vulnerabilities. |
|
|
Cisco NX-OS NXAPI Multiple Vulnerabilities. |
Additional Information
- Cisco Advisory
- Learn more about Tenable.io, the first Cyber Exposure platform for holistic management of your modern attack surface
- Get a free 60-day trial of Tenable.io Vulnerability Management
Related Articles
Cybersecurity Snapshot: Apply Zero Trust to Critical Infrastructure’s OT/ICS, CSA Advises, as Five Eyes Spotlight Tech Startups’ Security
November 1, 2024Should critical infrastructure orgs boost OT/ICS systems’ security with zero trust? Absolutely, the CSA says. Meanwhile, the Five Eyes countries offer cyber advice to tech startups. Plus, a survey finds “shadow AI” weakening data governance. And get the latest on MFA methods, CISO trends and Uncle Sam’s AI strategy.
FY 2024 State and Local Cybersecurity Grant Program Adds CISA KEV as a Performance Measure
October 31, 2024The CISA Known Exploited Vulnerabilities (KEV) catalog and enhanced logging guidelines are among the new measurement tools added for the 2024 State and Local Cybersecurity Grant Program.
Cybersecurity Snapshot: New Guides Offer Best Practices for Preventing Shadow AI and for Deploying Secure Software Updates
October 25, 2024Looking for help with shadow AI? Want to boost your software updates’ safety? New publications offer valuable tips. Plus, learn why GenAI and data security have become top drivers of cyber strategies. And get the latest on the top “no-nos” for software security; the EU’s new cyber law; and CISOs’ communications with boards.