Cisco ASA Software vulnerabilities

A vulnerability in the Identity Firewall feature of Cisco ASA Software before version 9.6(2.1) could allow an unauthenticated, remote attacker to cause a reload of the affected system or to remotely execute code. The issue is due to a buffer overflow in the affected code area.

A vulnerability in the local Certificate Authority (CA) feature of Cisco ASA Software before version 9.6(1.5) could allow an unauthenticated, remote attacker to cause a reload of the affected system. The issue is due to improper handling of crafted packets during the enrollment operation.

The Clientless SSL VPN portal in Cisco ASA Software before version 8.2(5.51), 8.3(2.42), 8.4(7.23), 8.6(1.15), 9.0(4.24), 9.1(5.12), 9.2(2.8), and 9.3(1.1) allows remote attackers to obtain sensitive information from process memory or modify memory contents via crafted parameters.

The VPN implementation in Cisco ASA Software versions before 7.2(5.15), 8.2(5.51), 8.3(2.42), 8.4(7.23), 8.6(1.15), 9.0(4.24), 9.1(5.12), 9.2(2.6), and 9.3(1.1) does not properly implement a tunnel filter, allowing remote authenticated users to gain failover-unit access via crafted packets.

The DNS inspection engine in Cisco ASA Software 9.0 before 9.0(4.13), 9.1 before 9.1(5.7), and 9.2 before 9.2(2) allows remote attackers to cause a denial of service (device reload) via crafted DNS packets.

The SunRPC inspection engine in Cisco ASA Software before versions 7.2(5.14), 8.2(5.51), 8.3(2.42), 8.4(7.23), 8.5(1.21), 8.6(1.14), 8.7(1.13), 9.0(4.5), and 9.1(5.3) allows remote attackers to cause a denial of service (device reload) via crafted SunRPC packets.

The GPRS Tunneling Protocol (GTP) inspection engine in Cisco ASA Software before version 8.2(5.51), 8.4(7.15), 8.7(1.13), 9.0(4.8), and 9.1(5.1) allows remote attackers to cause a denial of service (device reload) via a crafted series of GTP packets.

A race condition in the Health and Performance Monitoring (HPM) for ASDM feature in Cisco ASA allows remote attackers to cause a denial of service by generating many half-open TCP connections simultaneously.

The IKEv2 implementation in Cisco ASA Software before versions 8.4(7.15), 8.6(1.14), 9.0(4.8), and 9.1(5.1) allows remote attackers to cause a denial of service by sending a crafted packet during tunnel creation.

The IKE implementation in the VPN component in Cisco ASA Software 9.1 before 9.1(5.1) allows remote attackers to cause a denial of service (device reload) via crafted UDP packets.

The SQL*Net inspection engine in Cisco ASA Software before versions 7.2(5.13), 8.2(5.50), 8.3(2.42), 8.4(7.15), 8.5(1.21), 8.6(1.14), 8.7(1.13), 9.0(4.5), and 9.1(5.1) allows remote attackers to cause a denial of service (device reload) via crafted SQL REDIRECT packets.

A vulnerability in the SSL VPN functionality of Cisco ASA Software could allow an unauthenticated, remote attacker to cause a reload of the affected system or to remotely execute code. The issue is due to a double-free memory condition when the webvpn feature is enabled. An attacker could exploit this by sending multiple crafted XML packets to a webvpn-configured interface.

A vulnerability in the Remote Access VPN feature of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to cause an unexpected reload of the device, resulting in a denial of service (DoS). The issue is due to improper validation of client key data after the TLS session is established. An attacker could exploit this by sending a crafted key value over the secure TLS session.

A vulnerability in the TLS cryptography functionality of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to cause an unexpected reload of the device, resulting in a denial of service (DoS). The issue is due to improper data validation during the TLS 1.3 handshake. An attacker could exploit this by sending a crafted TLS 1.3 packet to a listening socket. It can also impact device integrity by causing VPN HostScan communication failures or file transfer failures during ASDM upgrades.

A vulnerability in the login authentication of the Remote Access SSL VPN feature of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to deny further VPN user authentications for several minutes, resulting in a temporary DoS. This is due to ineffective memory resource handling during authentication. An attacker could send crafted packets to cause resource exhaustion.

A vulnerability in the Dynamic Access Policies (DAP) feature of Cisco ASA and FTD Software could allow an authenticated, remote attacker to cause an unexpected reload of an affected device. To exploit this, an attacker would need valid remote access VPN user credentials. The issue is due to improper validation of data in HTTPS POST requests. An attacker could exploit this by sending a crafted HTTPS POST request.

A vulnerability in the SSL VPN feature of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to cause an unexpected reload of the device, resulting in a denial of service (DoS). The issue is due to a logic error in memory management when handling SSL VPN connections. An attacker could exploit this by sending crafted SSL/TLS packets to the SSL VPN server.

A vulnerability in the AnyConnect firewall for Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to bypass a configured ACL and allow traffic that should have been denied. This is due to a logic error in populating group ACLs when an AnyConnect client establishes a new session. An attacker could exploit this by establishing an AnyConnect connection to the affected device.

Multiple vulnerabilities in the per-user-override feature of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to bypass a configured ACL and allow traffic that should be denied. These vulnerabilities are due to a logic error in constructing and applying per-user-override rules. A successful exploit could allow the attacker to bypass the interface ACL and access protected resources.

Multiple vulnerabilities in the per-user-override feature of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to bypass a configured ACL and allow traffic that should be denied. These vulnerabilities are due to a logic error in constructing and applying per-user-override rules. A successful exploit could allow the attacker to bypass the interface ACL and access protected resources.

A vulnerability in the SSL/TLS client of Cisco ASA and FTD Software could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The issue is due to improper memory management when a device initiates SSL/TLS connections. An attacker could exploit this by ensuring the device connects to an SSL/TLS server using specific encryption parameters.

A vulnerability in the web services interface for remote access VPN features of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS). The issue is due to improper input validation when parsing HTTPS requests. Exploitation involves sending a crafted HTTPS request.

A vulnerability in an IPsec VPN library of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to read or modify data within an IPsec IKEv2 VPN tunnel. The issue is due to an improper implementation of Galois/Counter Mode (GCM) ciphers. An attacker in a man-in-the-middle position could intercept a sufficient number of encrypted messages and break the encryption, allowing decryption, reading, modification, and re-encryption of data.

A vulnerability in the SSL/TLS message handler of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS). The issue is due to improper processing of incoming SSL/TLS packets. Exploitation involves sending a crafted SSL/TLS packet.

A vulnerability in the memory management of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS). The issue is due to improper resource management when connection rates are high. Exploitation involves opening a significant number of connections.

A vulnerability in the software-based SSL/TLS message handler of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to reload the device, causing a denial of service (DoS). The issue is due to insufficient validation of SSL/TLS messages during software-based decryption. Exploitation involves sending a crafted SSL/TLS message.

A vulnerability in the OSPFv2 implementation of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to reload the device, causing a denial of service (DoS). The issue is due to incomplete input validation when processing OSPFv2 packets with LLS data. Exploitation involves sending a malformed OSPFv2 packet.

A vulnerability in ARP packet processing of Cisco ASA and Firepower Threat Defense (FTD) Software for Firepower 2100 Series could allow an unauthenticated, adjacent attacker to cause a device reload, resulting in a denial of service (DoS). The issue is due to incorrect processing of ARP packets on the management interface. An attacker could exploit this by sending a series of unicast ARP packets in a short timeframe, consuming resources and preventing keepalives, leading to a reload.

A vulnerability in the OSPF implementation of Cisco ASA and FTD Software could allow an unauthenticated, adjacent attacker to cause a reload of an affected device, resulting in a denial of service (DoS). The issue is due to improper parsing of certain options in OSPF LSA type 11 packets. An attacker could exploit this by sending a crafted LSA type 11 OSPF packet.