Friday, November 1, 2024
HomeCiscoAlert! Cisco Releases Critical Security Updates to Fix 2 ASA Firewall 0-Days

Alert! Cisco Releases Critical Security Updates to Fix 2 ASA Firewall 0-Days

Published on

Malware protection

Cisco has released critical security updates to address multiple vulnerabilities in its Adaptive Security Appliance (ASA) devices and Firepower Threat Defense (FTD) software, collectively known as the “ArcaneDoor” vulnerabilities.

If exploited, these vulnerabilities could allow a cyber threat actor to take control of an affected system.

The Cybersecurity and Infrastructure Security Agency (CISA) has added two vulnerabilities to its Known Exploited Vulnerabilities Catalog, indicating active exploitation in the wild.

- Advertisement - SIEM as a Service

Recently, GBHackers on Security reported that a sophisticated cyber espionage campaign dubbed “ArcaneDoor” conducted by a state-sponsored threat actor tracked as UAT4356 to exploit these 2 zero-day vulnerabilities (CVE-2024-20353 and CVE-2024-20359) in Cisco’s Adaptive Security Appliance (ASA) firewalls.

Combat Email Threats with Free Phishing Simulations: Email Security Awareness Training ->Try Free Demo 

CVE-2024-20353 and CVE-2024-20359: Persistent Remote Code Execution Vulnerabilities

These two vulnerabilities tracked as CVE-2024-20353 and CVE-2024-20359, are persistent remote code execution vulnerabilities in Cisco ASA and FTD software.

They allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system with root-level privileges.

The vulnerabilities exist due to improper handling of certain HTTP requests and improper sanitization of user-supplied data.

An attacker could exploit these vulnerabilities by sending crafted HTTP requests to a targeted device, potentially leading to complete system compromise.

“To determine whether a device that is running Cisco ASA Software or FTD Software is affected, use the show asp table socket | include SSL command and look for an SSL listen socket on any TCP port.”

If a socket is present in the output, the device should be considered vulnerable. The following example shows the output for a Cisco ASA device with two SSL listen sockets on TCP port 443 and TCP port 8443:

ciscoasa#  show asp table socket | include SSL
SSL 00185038 LISTEN 172.16.0.250:443 0.0.0.0:*
SSL 00188638 LISTEN 10.0.0.250:8443 0.0.0.0:*

Cisco has confirmed active exploitation of these vulnerabilities and has released software updates to address them. No workarounds are available, and users are strongly encouraged to apply the necessary updates immediately.

CVE-2024-20358: Web Services Denial of Service Vulnerability

CVE-2024-20358 is a denial of service (DoS) vulnerability in the management and VPN web servers of Cisco ASA and FTD software.

An unauthenticated, remote attacker could cause the affected device to reload unexpectedly, resulting in a DoS condition.

The vulnerability is due to incomplete error checking when parsing an HTTP header.

An attacker could exploit this vulnerability by sending a crafted HTTP request to a targeted web server on the device, causing it to reload and become unavailable.

This vulnerability affects the Cisco ASA restore CLI command that is described in the Software and Configurations chapter of the Cisco ASA Series General Operations CLI Configuration Guide.

This vulnerability does not affect the backup restore functionalities documented in the System Management chapter of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager and the Backup and Restore chapter of the Firepower Management Center Configuration Guide.

Cisco has released software updates to address this vulnerability, and there are no workarounds available.

Is Your Network Under Attack? - Read CISO’s Guide to Avoiding the Next Breach - Download Free Guide

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

LightSpy iOS Malware Enhanced with 28 New Destructive Plugins

The LightSpy threat actor exploited publicly available vulnerabilities and jailbreak kits to compromise iOS...

ATPC Cyber Forum to Focus on Next Generation Cybersecurity and Artificial Intelligence Issues

White House National Cyber Director, CEOs, Key Financial Services Companies, Congressional and Executive Branch...

New PySilon RAT Abusing Discord Platform to Maintain Persistence

Cybersecurity experts have identified a new Remote Access Trojan (RAT) named PySilon. This Trojan...

Konni APT Hackers Attacking Organizations with New Spear-Phishing Tactics

The notorious Konni Advanced Persistent Threat (APT) group has intensified its cyber assault on...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

LightSpy iOS Malware Enhanced with 28 New Destructive Plugins

The LightSpy threat actor exploited publicly available vulnerabilities and jailbreak kits to compromise iOS...

New PySilon RAT Abusing Discord Platform to Maintain Persistence

Cybersecurity experts have identified a new Remote Access Trojan (RAT) named PySilon. This Trojan...

Konni APT Hackers Attacking Organizations with New Spear-Phishing Tactics

The notorious Konni Advanced Persistent Threat (APT) group has intensified its cyber assault on...