Cisco advised that the Adaptive Security Appliance (ASA) and Firepower systems are being exploited in the wild with a Session Initiation Protocol (SIP) vulnerability. There is currently no patch.
Background
Cisco posted an advisory today warning users that their popular Adaptive Security Appliance (ASA) and Firepower Threat Defense Software are vulnerable to a Session Initiation Protocol (SIP) handling bug currently being exploited in the wild. As of November 1 10:00 a.m. (EST), there is no patch or workaround available. In the meantime, Cisco has provided mitigation guidance.
Impact assessment
According to Cisco: “While the vulnerability described in this advisory is being actively exploited, the output of show conn port 5060 will show a large number of incomplete SIP connections and the output of show processes cpu-usage non-zero sorted will show a high CPU utilization. Successful exploitation of this vulnerability can also result in a denial of service (DOS) causing the affected device to crash and reload. After the device boots up again, the output of show crashinfo will show an unknown abort of the DATAPATH thread.”
Vulnerability details
The vulnerability is reportedly caused by improper SIP inspection. SIP is a common protocol used for voice over IP (VoIP). It is also used for file transfer, instant messaging, video conferencing and streaming media. SIP can be run over TCP, UDP or other networking protocols.The following Cisco devices are listed as affected:
- 3000 Series Industrial Security Appliance (ISA)
- ASA 5500-X Series Next-Generation Firewalls
- ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers
- Adaptive Security Virtual Appliance (ASAv)
- Firepower 2100 Series Security Appliance
- Firepower 4100 Series Security Appliance
- Firepower 9300 ASA Security Module
- FTD Virtual (FTDv)
The vulnerability reportedly does not impact the following devices:
- ASA 1000V Cloud Firewall
- ASA 5500 Series Adaptive Security Appliances
Urgently required actions
Due to the fact this issue is reportedly being exploited in the wild and the “default on” nature of SIP inspection, users are urged to apply the mitigations provided by Cisco ASAP. Several mitigating controls are provided:
- Disabling SIP inspection (on by default): Disabling SIP inspection will completely close the attack vector for this vulnerability. However, it may not be suitable for everyone. In particular, disabling SIP inspection would break SIP connections if either Network Address Translation (NAT) is applied to SIP traffic or if not all ports required for SIP communication are opened via ACL. To disable SIP inspection, configure the following:
Cisco ASA Software and Cisco FTD Software Releases 6.2 and later (in FTD 6.2 and later use Cisco FMC to add the following via FlexConfig policy):
<code>
policy-map global_policy
class inspection_default
no inspect sip
Cisco FTD Software Releases prior to 6.2:
configure inspection sip disable
</code>
Additionally, the mitigations below are described in the advisory:
- Blocking the attacking host
- Filtering on Sent-by Address of 0.0.0.0, as that address has reportedly been used by attackers in ongoing exploitation
Identifying affected systems
Tenable is actively monitoring for any updates provided by Cisco and will provide plugin coverage as soon as it becomes available.
Get more information
Learn more about Tenable.io, the first Cyber Exposure platform for holistic management of your modern attack surface. Get a free 60-day trial of Tenable.io Vulnerability Management.