Cisco ASA and Firepower Being Exploited in the Wild - Apply Mitigations ASAP

Cisco advised that the Adaptive Security Appliance (ASA) and Firepower systems are being exploited in the wild with a Session Initiation Protocol (SIP) vulnerability. Limited patches are available.

Background

Cisco posted an advisory on October 31 warning users that their popular Adaptive Security Appliance (ASA) and Firepower Threat Defense Software are vulnerable to a Session Initiation Protocol (SIP) handling bug currently being exploited in the wild. As of November 1 10:00 a.m. (EST), there was no patch or workaround available. Cisco has provided mitigation guidance.

Updated November 9: Cisco has started releasing updated versions and has a limited set of fixes available on their advisory page.

Updated November 19: Cisco has finalized the 'Fixed Software' section of their advisory for users looking for support and updates for this vulnerability.

Impact assessment

According to Cisco: “While the vulnerability described in this advisory is being actively exploited, the output of show conn port 5060 will show a large number of incomplete SIP connections and the output of show processes cpu-usage non-zero sorted will show a high CPU utilization. Successful exploitation of this vulnerability can also result in a denial of service (DOS) causing the affected device to crash and reload. After the device boots up again, the output of show crashinfo will show an unknown abort of the DATAPATH thread.”

Vulnerability details

The vulnerability is reportedly caused by improper SIP inspection. SIP is a common protocol used for voice over IP (VoIP). It is also used for file transfer, instant messaging, video conferencing and streaming media. SIP can be run over TCP, UDP or other networking protocols. The following Cisco devices are listed as affected:

• 3000 Series Industrial Security Appliance (ISA)
• ASA 5500-X Series Next-Generation Firewalls
• ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers
• Adaptive Security Virtual Appliance (ASAv)
• Firepower 2100 Series Security Appliance
• Firepower 4100 Series Security Appliance
• Firepower 9300 ASA Security Module
• FTD Virtual (FTDv)

The vulnerability reportedly does not impact the following devices:

• ASA 1000V Cloud Firewall
• ASA 5500 Series Adaptive Security Appliances

Urgently required actions

Due to the fact this issue is reportedly being exploited in the wild and the “default on” nature of SIP inspection, users are urged to update immediately or apply the mitigations provided by Cisco ASAP. Several mitigating controls are provided:

• Disabling SIP inspection (on by default): Disabling SIP inspection will completely close the attack vector for this vulnerability. However, it may not be suitable for everyone. In particular, disabling SIP inspection would break SIP connections if either Network Address Translation (NAT) is applied to SIP traffic or if not all ports required for SIP communication are opened via ACL. To disable SIP inspection, configure the following:

Cisco ASA Software and Cisco FTD Software Releases 6.2 and later (in FTD 6.2 and later use Cisco FMC to add the following via FlexConfig policy):

policy-map global_policy
class inspection_default
no inspect sip

Cisco FTD Software Releases prior to 6.2:

configure inspection sip disable

Additionally, the mitigations below are described in the advisory:

• Blocking the attacking host
• Filtering on Sent-by Address of 0.0.0.0, as that address has reportedly been used by attackers in ongoing exploitation
• Rate limiting SIP traffic

Identifying affected systems

A list of Nessus plugins to identify this vulnerability can be found here.

Get more information

• Cisco Advisory

Learn more about Tenable.io, the first Cyber Exposure platform for holistic management of your modern attack surface. Get a free 60-day trial of Tenable.io Vulnerability Management.