Pierluigi Paganini
May 08, 2020
Cisco released security updates to address 34 flaws in multiple products, including 12 high severity vulnerabilities that affect Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD). Most of the vulnerabilities fixed by Cisco are denial of service.
The most severe issue, tracked as CVE-2020-3187, is a Path Traversal Vulnerability in Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services. The issue could be exploited by unauthenticated, remote attackers to conduct directory traversal attacks and then read or delete sensitive files on a vulnerable system.
An attacker could trigger the flaw by sending a crafted HTTP request containing directory traversal character sequences.
“A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct directory traversal attacks and obtain read and delete access to sensitive files on a targeted system.” reads the advisory published by Cisco.
“The vulnerability is due to a lack of proper input validation of the HTTP URL. An attacker could exploit this vulnerability by sending a crafted HTTP request containing directory traversal character sequences. An exploit could allow the attacker to view or delete arbitrary files on the targeted system. When the device is reloaded after exploitation of this vulnerability, any files that were deleted are restored. The attacker can only view and delete files within the web services file system.”
The vulnerability received the CVSS score of 9.1.
The issue is caused by the lack of proper input validation of the HTTP URL, that fail to check the crafted HTTP request that includes directory traversal character sequences. Cisco pointed out that the vulnerability can not be exploited to obtain access to ASA or FTD system files or underlying operating system (OS) files.
Cisco also fixed security issued in ASA Software releases 9.6.4.40, 9.8.4.15, 9.9.2.66, 9.10.1.37, 9.12.3.2, and 9.13.1.7; and FTD Software release 6.4.0.8 and 6.5.0.4 (future releases 6.2.3.16 and 6.3.0.6 also include the patches).
Below the list of vulnerabilities addressed by Cisco:
| CVE | Vulnerability Type | Products Affected | CVSSv3 |
|---|---|---|---|
| CVE-2020-3187 | Path Traversal | ASA, FTD | 9.1 |
| CVE-2020-3195 | Memory Leak | ASA, FTD | 8.6 |
| CVE-2020-3179 | Denial of Service | FTD | 8.6 |
| CVE-2020-3191 | Denial of Service | ASA, FTD | 8.6 |
| CVE-2020-3196 | Denial of Service | ASA, FTD | 8.6 |
| CVE-2020-3254 | Denial of Service | ASA, FTD | 8.6 |
| CVE-2020-3283 | Denial of Service | Firepower | 8.6 |
| CVE-2020-3298 | Denial of Service | ASA, FTD | 8.6 |
| CVE-2020-3189 | Denial of Service | FTD | 8.6 |
| CVE-2020-3125 | Authentication Bypass | ASA | 8.1 |
| CVE-2020-3255 | Denial of Service | FTD | 7.5 |
| CVE-2020-3259 | Information Disclosure | ASA, FTD | 7.5 |
Other high-risk vulnerabilities addressed by Cisco patched this week include an authentication bypass in the Kerberos authentication feature of ASA (CVE-2020-3125), information disclosure in the web services interface of ASA and FTD (CVE-2020-3259), and a memory leak in the Open Shortest Path First (OSPF) implementation in ASA and FTD (CVE-2020-3195).
At the time, there were no proofs-of-concept available for any of the issues included in the advisories published by Cisco.
Cisco said it is not aware of public exploits for these vulnerabilities, or of attacks exploiting them in the wild.
Please vote Security Affairs for European Cybersecurity Blogger Awards – VOTE FOR YOUR WINNERS
https://docs.google.com/forms/d/e/1FAIpQLSe8AkYMfAAwJ4JZzYRm8GfsJCDON8q83C9_wu5u10sNAt_CcA/viewform
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – Cisco ASA, hacking)
[adrotate banner=”5″]
[adrotate banner=”13″]
