CERT-In Advisory CIAD-2007-54
Multiple Vulnerabilities in Cisco PIX and ASA Appliances

Original issue date: October 24, 2007

Severity Rating: High

Systems Affected

• Cisco Adaptive Security Appliance (ASA) 7.x
• Cisco Adaptive Security Appliance (ASA) 8.x
• Cisco PIX 7.x
• Cisco PIX 8.x

Overview

Two crafted packet vulnerabilities exist in the Cisco PIX 500 Series Security Appliance (PIX) and the Cisco 5500 Series Adaptive Security Appliance (ASA). Successful exploitation of these vulnerabilities will reload the affected device. Repeated exploitation can cause a denial of service (DoS) condition. These vulnerabilities are triggered during processing of Media Gateway Control Protocol (MGCP) packets, or during processing of Transport Layer Security (TLS) traffic that terminates on the PIX or ASA security appliance .

Description

The following vulnerabilities exist in the Cisco PIX and ASA are independent of each other.

1. Crafted MGCP Packet

MGCP is a protocol for controlling media gateways from external call control elements such as Media Gateway Controllers or Call Agents. Cisco PIX or ASA security appliance with the Media Gateway Control Protocol (MGCP) application layer protocol inspection feature enabled may reload when the device processes a crafted MGCP packet.

2. Crafted TLS Packet

Transport Layer Security (TLS) is the replacement for the Secure Socket Layer (SSL) protocol. It is a protocol that provides secure communications between two end-points, via cryptography. The PIX and ASA may be affected by vulnerability in the handling of the TLS protocol that may lead to reload the device when specially crafted TLS packets are processed.

Applications affected by this vulnerability are clientless Web-VPN connections, HTTPS management sessions, cut-through proxy for network access, and TLS proxy for encrypted voice inspection.

Workaround

• Crafted MGCP Packets: Use appropriate access-list.
• Crafted TLS Packet: Restrict access to trusted hosts only.
• There are no workarounds if the clientless WebVPN, cut-through proxy for network access, and TLS proxy for encrypted voice inspection features are in use.

Vendor Information

Cisco
http://www.cisco.com/warp/public/707/cisco-sa-20071017-asa.shtml

References

SecurityFocus
http://www.securityfocus.com/archive/1/482438  

Secunia
http://secunia.com/advisories/27193/

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Phone: +91-11-24368572

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Communications and Information Technology
Electronics Niketan
6, C.G.O. Complex
New Delhi-110 003