I was snooping through Reddit(/r/networking) today keeping up on the latest and greatest in the IT world and I came across this new critical Cisco ASA remote code exec vulnerability advisory. The Cisco Security Advisory affects anyone running SSLVPN/AnyConnect on their ASA so I thought it was worth sharing. There is a summary below and the entire Cisco Security summary is available here: Cisco Adaptive Security Appliance Remote Code Execution and Denial of Service Vulnerability
A vulnerability in the Secure Sockets Layer (SSL) VPN functionality of the Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to cause a reload of the affected system or to remotely execute code.
The vulnerability is due to an attempt to double free a region of memory when the webvpn feature is enabled on the Cisco ASA device. An attacker could exploit this vulnerability by sending multiple, crafted XML packets to a webvpn-configured interface on the affected system. An exploit could allow the attacker to execute arbitrary code and obtain full control of the system, or cause a reload of the affected device.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
In the following tables, the left column lists major releases of Cisco ASA Software. The right column indicates whether a major release is affected by the vulnerability described in this advisory and the first release that includes the fix for this vulnerability. Customers should upgrade to an appropriate release as indicated in this section.
In the following table, the left column lists major releases of Cisco FTD Software. The right column indicates whether a major release is affected by the vulnerability described in this advisory and the first release that includes the fix for this vulnerability. Customers should upgrade to an appropriate release as indicated in this section.
If you need help with these fixes or upgrades contact EDCi, our experts are happy to help!
After broadening the investigation, Cisco engineers found other attack vectors and features that are affected by this vulnerability that were not originally identified. The original security patch did not identify or fix the entire problem, so a new fix for Cisco ASA platforms is now available. This means Cisco customers will have additional downtime for security maintenance in order to fix a bug that allows an unauthenticated, remote attacker to execute code and cause system reloads.
EDCi engineers are standing by and ready to help contact us today if you need assistance working though this vulnerability!