OTPulse

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software SSL VPN Denial of Service Vulnerability

Plan PatchCVSS 8.6cisco-sa-asaftdvirtual-dos-MuenGnYROct 23, 2024
CiscoEnergyManufacturingTransportation
IT in OT - Cisco networking products are commonly deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary

A vulnerability in the SSL VPN and management web servers of Cisco Secure Firewall ASA and FTD Software platforms allows an unauthenticated, remote attacker to cause a denial of service by sending a large number of new SSL/TLS connections. The attacker exploits a lack of proper memory management, causing the device to exhaust system memory or buffer blocks, which slows down and eventually stops SSL VPN connection processing. Cisco has released software updates that address this vulnerability. No workarounds are available.

What this means
What could happen
An attacker can flood your firewall with SSL/TLS connections to exhaust system memory, causing your SSL VPN to become unresponsive and potentially forcing a manual restart to restore service. This could block remote access and disrupt operations that depend on VPN connectivity.
Who's at risk
Energy utilities, manufacturing facilities, and transportation operators using Cisco Secure Firewall appliances (ASA or FTD platforms) for VPN connectivity and remote management should apply this patch. This includes both physical appliances (ASA 5500-X Series, Firepower 2100/4100/9000 Series, Secure Firewall 1200/3100/4200 Series) and virtual instances (ASAv, FTDv, ISA 3000 Series).
How it could be exploited
An attacker sends a large number of new SSL/TLS connection requests to your firewall's VPN or management web server from the internet. The firewall fails to properly manage memory for these connections, consuming available buffers until the device runs out of resources and SSL VPN connections slow down or stop completely.
Prerequisites
  • Network access to the SSL VPN or management web server port on the affected firewall (typically port 443)
  • No credentials required
  • Attacker can be unauthenticated
Remotely exploitableNo authentication requiredLow complexity attackHigh impact on availability (CVSS 8.6)
Exploitability
Unlikely to be exploited — EPSS score 0.6%
Affected products (11)
11 with fix
ProductAffected VersionsFix Status
Adaptive Security Virtual Appliance (ASAv)All versionsFix available
Firepower 2100 SeriesAll versionsFix available
Firepower 1000 SeriesAll versionsFix available
ASA 5500-X Series FirewallsAll versionsFix available
3000 Series Industrial Security Appliances (ISA)All versionsFix available
Firepower 9000 SeriesAll versionsFix available
Firepower 4100 SeriesAll versionsFix available
Secure Firewall 3100 SeriesAll versionsFix available
Remediation & Mitigation
0/4
Do now
0/2
WORKAROUNDImplement rate limiting or connection limits on SSL/TLS connections to the VPN and management ports
HARDENINGRestrict network access to SSL VPN and management web server ports to known source IPs or networks only
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXUpdate ASA Software or FTD Software to the patched version released by Cisco
Long-term hardening
0/1
HARDENINGMonitor firewall memory and buffer utilization in real time and set up alerts for abnormal consumption patterns
View full vendor advisory
API: /api/v1/advisories/79331a08-44f1-4f67-9f6c-ef8cd776be66

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.