Cisco Secure Firewall Adaptive Security Appliance (ASA) Software vulnerabilities

A vulnerability in the handling of connection limits in Cisco Secure Firewall ASA could allow an unauthenticated, remote attacker to incorrectly drop incoming TCP SYN packets. An attacker could exploit this vulnerability to block all incoming TCP connections to the device.

A vulnerability in the LUA interpreter of the Remote Access SSL VPN feature of Cisco Secure Firewall ASA and FTD Software could allow an authenticated, remote attacker with a valid VPN connection to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.

A vulnerability in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to send traffic that should be denied through an affected device. The issue is due to improper error handling when a device joining a cluster runs out of memory while replicating access control rules.

A vulnerability in the TLS 1.3 implementation for a specific cipher for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software for Firepower 3100 and 4200 Series devices could allow an authenticated, remote attacker to consume resources associated with incoming TLS 1.3 connections, eventually causing the device to stop accepting any new SSL/TLS or VPN requests. The issue is due to the implementation of the TLS 1.3 Cipher TLS_CHACHA20_POLY1305_SHA256. Sending a large number of TLS 1.3 connections with this cipher can cause a DoS condition where no new incoming encrypted connections are accepted. The device must be reloaded to clear this condition.