Buffer overflow in the IKEv1 and IKEv2 implementations in Cisco ASA Software before 8.4(7.30), 8.7 before 8.7(1.18), 9.0 before 9.0(4.38), 9.1 before 9.1(7), 9.2 before 9.2(4.5), 9.3 before 9.3(3.7), 9.4 before 9.4(2.4), and 9.5 before 9.5(2.2) on ASA 5500 devices, ASA 5500-X devices, ASA Services Module for Cisco Catalyst 6500 and Cisco 7600 devices, ASA 1000V devices, Adaptive Security Virtual Appliance (aka ASAv), Firepower 9300 ASA Security Module, and ISA 3000 devices allows remote attackers to execute arbitrary code or cause a denial of service (device reload) via crafted UDP packets, aka Bug IDs CSCux29978 and CSCux42019.

The remote Cisco Adaptive Security Appliance (ASA) or device running IOS / IOS XE is affected by one of the following vulnerabilities in the Internet Key Exchange (IKE) implementation :

  - An overflow condition exists in both the IKE and IKEv2     implementations due to improper validation of     user-supplied input when handling UDP packets. An     unauthenticated, remote attacker can exploit this issue,     via specially crafted UDP packets, to cause a buffer     overflow condition, resulting in a denial of service or     the execution of arbitrary code. (CVE-2016-1287)

  - A denial of service vulnerability exists in the IKEv2     implementation due to improper handling of fragmented     IKEv2 packets. An unauthenticated, remote attacker can     exploit this issue, via specially crafted UDP packets,     to cause the device to reload. (CVE-2016-1344)

The remote Cisco Adaptive Security Appliance (ASA) is missing a vendor-supplied security patch. It is, therefore, affected by a remote code execution vulnerability due to an overflow condition in the Internet Key Exchange (IKE) implementation. An unauthenticated, remote attacker can exploit this, via specially crafted UDP packets, to cause a denial of service or the execution of arbitrary code. Note that only systems configured in routed firewall mode and single / multiple context mode are affected.

The remote Cisco Adaptive Security Appliance (ASA) is missing a vendor-supplied security patch. It is, therefore, affected by a remote code execution vulnerability due to an overflow condition in the Internet Key Exchange (IKE) implementation. An unauthenticated, remote attacker can exploit this, via a specially crafted UDP packet, to cause a denial of service or the execution of arbitrary code. Note that only systems configured in routed firewall mode and single / multiple context mode are affected.

ID	Name	Product	Family	Severity
89033	Cisco ASA / IOS IKE Fragmentation Vulnerability	Nessus	CISCO	critical
88713	Cisco ASA Software IKEv1 and IKEv2 UDP Packet Handling RCE (cisco-sa-20160210-asa-ike)	Nessus	CISCO	critical
801954	Cisco ASA < 9.5(2.2) IKEv1 and IKEv2 UDP Packet Handling RCE (cisco-sa-20160210-asa-ike)	Log Correlation Engine	Generic	critical
801953	Cisco ASA < 9.4(2.4) IKEv1 and IKEv2 UDP Packet Handling RCE (cisco-sa-20160210-asa-ike)	Log Correlation Engine	Generic	critical
801952	Cisco ASA < 9.3(3.7) IKEv1 and IKEv2 UDP Packet Handling RCE (cisco-sa-20160210-asa-ike)	Log Correlation Engine	Generic	critical
801951	Cisco ASA < 9.2(4.5) IKEv1 and IKEv2 UDP Packet Handling RCE (cisco-sa-20160210-asa-ike)	Log Correlation Engine	Generic	critical
801950	Cisco ASA < 9.1(7) IKEv1 and IKEv2 UDP Packet Handling RCE (cisco-sa-20160210-asa-ike)	Log Correlation Engine	Generic	critical
801949	Cisco ASA < 9.0(4.38) IKEv1 and IKEv2 UDP Packet Handling RCE (cisco-sa-20160210-asa-ike)	Log Correlation Engine	Generic	critical
801948	Cisco ASA < 8.7(1.18) IKEv1 and IKEv2 UDP Packet Handling RCE (cisco-sa-20160210-asa-ike)	Log Correlation Engine	Generic	critical
801947	Cisco ASA 8.6 IKEv1 and IKEv2 UDP Packet Handling RCE (cisco-sa-20160210-asa-ike)	Log Correlation Engine	Generic	critical
801946	Cisco ASA < 8.4(7.30) IKEv1 and IKEv2 UDP Packet Handling RCE (cisco-sa-20160210-asa-ike)	Log Correlation Engine	Generic	critical

Detections

Analytics

CVE-2016-1287

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical