Rewterz Threat Advisory – CVE-2018-0296 – Cisco ASA and FTD Bug Attacked in Wild for DoS and Information Disclosure

Severity

High

Analysis Summary

An increase in attempts to exploit CVE-2018-0296 has been observed in the wild. The vulnerability is a denial-of-service and information disclosure directory traversal bug affecting Cisco Adaptive Security Appliance (ASA) and Firepower Appliances. A vulnerability in the web interface of the Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. It is also possible on certain software releases that the ASA will not reload, but an attacker could view sensitive system information without authentication by using directory traversal techniques. The vulnerability is due to lack of proper input validation of the HTTP URL. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. An exploit could allow the attacker to cause a DoS condition or unauthenticated disclosure of information. This vulnerability applies to IPv4 and IPv6 HTTP traffic.
Software updates have long been released by Cisco that address this vulnerability. There are no workarounds that address this vulnerability.

Impact

• Denial of Service
• Information Disclosure
• Authentication Bypass
• Directory Traversal

Affected Vendors

Cisco

Remediation

Customers should upgrade to an appropriate release as indicated in the following tables.

Cisco ASA Software

Cisco ASA Software releases prior to Release 9.1 and Cisco ASA Software Releases 9.3 and 9.5 have reached end-of-software maintenance. Customers should migrate to a supported release.

The software is available for download from the Software Center on Cisco.com by navigating to Products > Security > Firewalls > Adaptive Security Appliances (ASA) > ASA 5500-X Series Firewalls, where there is a list of Cisco ASA hardware platforms. The majority of these software releases are listed under Interim.

Cisco FTD Software

The software is available for download from the Software Center on Cisco.com by navigating to Products > Security > Firewalls > Next-Generation Firewalls (NGFW), where there is a list of Cisco FTD hardware platforms.