CERT-In Advisory
CIAD-2007-0054
Multiple Vulnerabilities in Cisco PIX and ASA Appliances
Original Issue Date: October 24, 2007
Severity Rating: High
Systems Affected
- Cisco Adaptive Security Appliance ASA 7.x
- Cisco Adaptive Security Appliance ASA 8.x
- Cisco PIX 7.x
- Cisco PIX 8.x
Overview
Two crafted packet vulnerabilities exist in the Cisco PIX 500 Series Security Appliance PIX and the Cisco 5500 Series Adaptive Security Appliance ASA . Successful exploitation of these vulnerabilities will reload the affected device. Repeated exploitation can cause a denial of service DoS condition. These vulnerabilities are triggered during processing of Media Gateway Control Protocol MGCP packets, or during processing of Transport Layer Security TLS traffic that terminates on the PIX or ASA security appliance .
Description
The following vulnerabilities exist in the Cisco PIX and ASA are independent of each other.
1. Crafted MGCP Packet
MGCP is a protocol for controlling media gateways from external call control elements such as Media Gateway Controllers or Call Agents. Cisco PIX or ASA security appliance with the Media Gateway Control Protocol MGCP application layer protocol inspection feature enabled may reload when the device processes a crafted MGCP packet.
2. Crafted TLS Packet
Transport Layer Security TLS is the replacement for the Secure Socket Layer SSL protocol. It is a protocol that provides secure communications between two end-points, via cryptography. The PIX and ASA may be affected by vulnerability in the handling of the TLS protocol that may lead to reload the device when specially crafted TLS packets are processed.
Applications affected by this vulnerability are clientless Web-VPN connections, HTTPS management sessions, cut-through proxy for network access, and TLS proxy for encrypted voice inspection.
Workaround
- Crafted MGCP Packets: Use appropriate access-list.
- Crafted TLS Packet: Restrict access to trusted hosts only.
- There are no workarounds if the clientless WebVPN, cut-through proxy for network access, and TLS proxy for encrypted voice inspection features are in use.
Vendor Information
Cisco
http://www.cisco.com/warp/public/707/cisco-sa-20071017-asa.shtml
References
SecurityFocus
http://www.securityfocus.com/archive/1/482438
Secunia
http://secunia.com/advisories/27193/
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|