Cisco Adaptive Security Appliance (ASA) vulnerabilities

The IKEv1 implementation in Cisco Adaptive Security Appliance (ASA) software before version 8.2(5.58), 8.3, 8.4(7.29), 8.5-8.7(1.17), 9.0(4.37), 9.1(6.8), 9.2(4), and 9.3(3) allows remote attackers to cause a denial of service (device reload) via crafted ISAKMP UDP packets.

Cisco Adaptive Security Appliance (ASA) software versions 7.2 and 8.2 before 8.2(5.58), 8.3, 8.4 before 8.4(7.29), 8.5 through 8.7 before 8.7(1.17), 9.0 before 9.0(4.37), 9.1 before 9.1(6.6), 9.2 before 9.2(4), 9.3 before 9.3(3.5), and 9.4 before 9.4(1.5) allows remote attackers to cause a denial of service (device reload) via a crafted DNS response.

Cisco Adaptive Security Appliance (ASA) software versions 7.2 and 8.2 before 8.2(5.58), 8.3 and 8.4 before 8.4(7.29), 8.5 through 8.7 before 8.7(1.17), 9.0 before 9.0(4.37), 9.1 before 9.1(6.4), 9.2 before 9.2(4), 9.3 before 9.3(3.1), and 9.4 before 9.4(1.1) allows remote attackers to cause a denial of service (device reload) via a crafted DNS response.

The DHCPv6 relay implementation in Cisco Adaptive Security Appliance (ASA) software before versions 9.0(4.37), 9.1(6.6), 9.2(4), 9.3(3.5), and 9.4(2) is vulnerable to remote attacks that can lead to denial of service via crafted DHCPv6 packets.

A vulnerability in the TCP packet processing of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device. The issue is due to a memory exhaustion condition. An attacker could exploit this by sending a high rate of crafted TCP traffic, potentially exhausting device resources and causing DoS for transiting traffic.

A vulnerability in the SSL/TLS handler of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to exhaust memory resources on the affected device, leading to a DoS condition. The issue is due to improper resource management for inbound SSL/TLS connections. An attacker could exploit this by establishing multiple SSL/TLS connections with specific conditions, potentially exhausting memory and causing the device to stop accepting new SSL/TLS connections. Manual intervention is required to recover.

A vulnerability in the TCP processing engine of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a DoS condition. The issue is due to improper handling of TCP traffic. An attacker could exploit this by sending a specific sequence of packets at a high rate, potentially causing temporary traffic disruption during reboot.

A vulnerability in the TCP proxy functionality for Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to cause the device to restart unexpectedly, resulting in a DoS condition. The issue is due to an error in TCP-based packet inspection, which can cause an invalid Layer 2 header. An attacker could exploit this by sending a crafted TCP packet sequence.

A vulnerability in the cryptographic hardware accelerator driver of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a temporary DoS condition. The issue exists because the devices have limited DMA memory and the software improperly handles resources in low-memory conditions. An attacker could exploit this by sending sustained high-rate malicious traffic, potentially exhausting DMA memory and causing a reload.

A vulnerability in the ingress flow creation functionality of Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, remote attacker to cause CPU utilization to increase upwards of 100%, leading to a denial of service (DoS) condition. The issue is due to incorrect handling of an internal software lock that can prevent other system processes from getting CPU cycles. An attacker could exploit this by sending a steady stream of malicious IP packets, potentially exhausting CPU resources and causing traffic delays.