Cisco released security updates to address 34 flaws in multiple products, including 12 high severity vulnerabilities that affect Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD). Most of the vulnerabilities fixed by Cisco are denial of service.
The most severe issue, tracked as CVE-2020-3187, is a Path Traversal Vulnerability in Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services. The issue could be exploited by unauthenticated, remote attackers to conduct directory traversal attacks and then read or delete sensitive files on a vulnerable system.
An attacker could trigger the flaw by sending a crafted HTTP request containing directory traversal character sequences.
“A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct directory traversal attacks and obtain read and delete access to sensitive files on a targeted system.” reads the advisory published by Cisco.
“The vulnerability is due to a lack of proper input validation of the HTTP URL. An attacker could exploit this vulnerability by sending a crafted HTTP request containing directory traversal character sequences. An exploit could allow the attacker to view or delete arbitrary files on the targeted system. When the device is reloaded after exploitation of this vulnerability, any files that were deleted are restored. The attacker can only view and delete files within the web services file system.”
The vulnerability received the CVSS score of 9.1.
The issue is caused by the lack of proper input validation of the HTTP URL, that fail to check the crafted HTTP request that includes directory traversal character sequences. Cisco pointed out that the vulnerability can not be exploited to obtain access to ASA or FTD system files or underlying operating system (OS) files.
Cisco also fixed security issued in ASA Software releases 220.127.116.11, 18.104.22.168, 22.214.171.124, 126.96.36.199, 188.8.131.52, and 184.108.40.206; and FTD Software release 220.127.116.11 and 18.104.22.168 (future releases 22.214.171.124 and 126.96.36.199 also include the patches).
Below the list of vulnerabilities addressed by Cisco:
|CVE||Vulnerability Type||Products Affected||CVSSv3|
|CVE-2020-3187||Path Traversal||ASA, FTD||9.1|
|CVE-2020-3195||Memory Leak||ASA, FTD||8.6|
|CVE-2020-3179||Denial of Service||FTD||8.6|
|CVE-2020-3191||Denial of Service||ASA, FTD||8.6|
|CVE-2020-3196||Denial of Service||ASA, FTD||8.6|
|CVE-2020-3254||Denial of Service||ASA, FTD||8.6|
|CVE-2020-3283||Denial of Service||Firepower||8.6|
|CVE-2020-3298||Denial of Service||ASA, FTD||8.6|
|CVE-2020-3189||Denial of Service||FTD||8.6|
|CVE-2020-3255||Denial of Service||FTD||7.5|
|CVE-2020-3259||Information Disclosure||ASA, FTD||7.5|
Other high-risk vulnerabilities addressed by Cisco patched this week include an authentication bypass in the Kerberos authentication feature of ASA (CVE-2020-3125), information disclosure in the web services interface of ASA and FTD (CVE-2020-3259), and a memory leak in the Open Shortest Path First (OSPF) implementation in ASA and FTD (CVE-2020-3195).
At the time, there were no proofs-of-concept available for any of the issues included in the advisories published by Cisco.
Cisco said it is not aware of public exploits for these vulnerabilities, or of attacks exploiting them in the wild.
Please vote Security Affairs for European Cybersecurity Blogger Awards – VOTE FOR YOUR WINNERS
(SecurityAffairs – Cisco ASA, hacking)
Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.
Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.