Cisco ASA/Firepower Threat Defense TFC over IPsec key management

Summaryinfo

A vulnerability was found in Cisco ASA and Firepower Threat Defense. It has been declared as problematic. The affected element is an unknown function of the component TFC over IPsec. Executing a manipulation can lead to key management. This vulnerability is registered as CVE-2018-15397. It is possible to launch the attack remotely. No exploit is available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Cisco ASA and Firepower Threat Defense (Firewall Software) (version now known). It has been declared as problematic. This vulnerability affects some unknown processing of the component TFC over IPsec. The manipulation with an unknown input leads to a key management vulnerability. The CWE definition for the vulnerability is CWE-320. As an impact it is known to affect availability. CVE summarizes:

A vulnerability in the implementation of Traffic Flow Confidentiality (TFC) over IPsec functionality in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to restart unexpectedly, resulting in a denial of service (DoS) condition. The vulnerability is due to an error that may occur if the affected software renegotiates the encryption key for an IPsec tunnel when certain TFC traffic is in flight. An attacker could exploit this vulnerability by sending a malicious stream of TFC traffic through an established IPsec tunnel on an affected device. A successful exploit could allow the attacker to cause a daemon process on the affected device to crash, which could cause the device to crash and result in a DoS condition.

The bug was discovered 10/03/2018. The weakness was published 10/05/2018 as cisco-sa-20181003-asa-ipsec-do as confirmed advisory (Website). The advisory is shared for download at tools.cisco.com. This vulnerability was named CVE-2018-15397 since 08/17/2018. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1600.001.

The vulnerability was handled as a non-public zero-day exploit for at least 2 days. During that time the estimated underground price was around $5k-$25k. The commercial vulnerability scanner Qualys is able to test this issue with plugin 316348 (Cisco Adaptive Security Appliance IPsec VPN Denial of Service Vulnerability(cisco-sa-20181003-asa-ipsec-dos)).

Upgrading eliminates this vulnerability.

Similar entry is available at VDB-124901. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Firewall Software

Vendor

• Cisco

Name

• ASA
• Firepower Threat Defense

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion