Cisco Security Advisory Cisco ASA RCE and DoS Vulnerability
tools.cisco.com
tools.cisco.com
Fun stuff: https://www.nccgroup.trust/uk/about-us/newsroom-and-events/b... https://github.com/nccgroup/asatools
My favourite recent one was the slapstick Fortinet one, https://blog.cryptographyengineering.com/2017/10/23/attack-o...
(Same goes for terminating TLS at load balancers)
It has good stories around user management and access control. There are literally millions of people able to configure it well enough to work. It has an excellent reputation for stability and security among it's client base (which is not the same as actually being very secure, mind). It has good (albeit expensive) commercial support. It works well with most desktop and mobiles OSes. It's easy for non-technical users to use it. Etc, etc.
The advisory says:
> The Cisco Product Security Incident Response Team (PSIRT) is aware of public knowledge of the vulnerability that is described in this advisory. Cisco PSIRT is not aware of any malicious use of the vulnerability described in this advisory.
... though I'm guessing that will change in the very near future.
Time to go reconfigure and/or update some firewalls...
That's not to say that this isn't a severe vulnerability, but rather that plenty of vulnerabilities that don't get a "10.0" are just as bad.
The pragmatic, conservative way to look at these kinds of announcements is:
* Assume any vulnerability that refers to memory corruption (really, "memory" of any sort not qualified by "reading", which is itself a pretty bad vulnerability) is remote code execution.
* Assume potential remote code execution is remote code execution.
* Assume remote code execution or denial of service is remote code execution.
* If the announcement doesn't clearly indicate that the vulnerability requires authentication to exploit, assume it's pre-auth.
If you have an ASA that hasn't been updated today, you are vulnerable to DoS and RCE vulnerabilities.
That is, as far as I'm concerned, about as bad as it gets (we've got, I dunno, several dozen of these).
I realize that, like everything, CVSS scores aren't perfect. But as a general "how bad is this?" indicator, I do think it's useful and, in this case, the 10.0 does the job of pointing out, "It's bad".
Edit: Credit to the folks at NCC Group - they’ve picked up a few ASA vulnerabilities now.