Friday, May 24, 2024

Alert! Cisco Releases Critical Security Updates to Fix 2 ASA Firewall 0-Days

Cisco has released critical security updates to address multiple vulnerabilities in its Adaptive Security Appliance (ASA) devices and Firepower Threat Defense (FTD) software, collectively known as the “ArcaneDoor” vulnerabilities.

If exploited, these vulnerabilities could allow a cyber threat actor to take control of an affected system.

The Cybersecurity and Infrastructure Security Agency (CISA) has added two vulnerabilities to its Known Exploited Vulnerabilities Catalog, indicating active exploitation in the wild.

Recently, GBHackers on Security reported that a sophisticated cyber espionage campaign dubbed “ArcaneDoor” conducted by a state-sponsored threat actor tracked as UAT4356 to exploit these 2 zero-day vulnerabilities (CVE-2024-20353 and CVE-2024-20359) in Cisco’s Adaptive Security Appliance (ASA) firewalls.

Combat Email Threats with Free Phishing Simulations: Email Security Awareness Training ->Try Free Demo 

CVE-2024-20353 and CVE-2024-20359: Persistent Remote Code Execution Vulnerabilities

These two vulnerabilities tracked as CVE-2024-20353 and CVE-2024-20359, are persistent remote code execution vulnerabilities in Cisco ASA and FTD software.

They allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system with root-level privileges.

The vulnerabilities exist due to improper handling of certain HTTP requests and improper sanitization of user-supplied data.

An attacker could exploit these vulnerabilities by sending crafted HTTP requests to a targeted device, potentially leading to complete system compromise.

“To determine whether a device that is running Cisco ASA Software or FTD Software is affected, use the show asp table socket | include SSL command and look for an SSL listen socket on any TCP port.”

If a socket is present in the output, the device should be considered vulnerable. The following example shows the output for a Cisco ASA device with two SSL listen sockets on TCP port 443 and TCP port 8443:

ciscoasa#  show asp table socket | include SSL
SSL 00185038 LISTEN 172.16.0.250:443 0.0.0.0:*
SSL 00188638 LISTEN 10.0.0.250:8443 0.0.0.0:*

Cisco has confirmed active exploitation of these vulnerabilities and has released software updates to address them. No workarounds are available, and users are strongly encouraged to apply the necessary updates immediately.

CVE-2024-20358: Web Services Denial of Service Vulnerability

CVE-2024-20358 is a denial of service (DoS) vulnerability in the management and VPN web servers of Cisco ASA and FTD software.

An unauthenticated, remote attacker could cause the affected device to reload unexpectedly, resulting in a DoS condition.

The vulnerability is due to incomplete error checking when parsing an HTTP header.

An attacker could exploit this vulnerability by sending a crafted HTTP request to a targeted web server on the device, causing it to reload and become unavailable.

This vulnerability affects the Cisco ASA restore CLI command that is described in the Software and Configurations chapter of the Cisco ASA Series General Operations CLI Configuration Guide.

This vulnerability does not affect the backup restore functionalities documented in the System Management chapter of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager and the Backup and Restore chapter of the Firepower Management Center Configuration Guide.

Cisco has released software updates to address this vulnerability, and there are no workarounds available.

Is Your Network Under Attack? - Read CISO’s Guide to Avoiding the Next Breach - Download Free Guide

Website

Latest articles

Hackers Weaponizing Microsoft Access Documents To Execute Malicious Program

In multiple aggressive phishing attempts, the financially motivated organization UAC-0006 heavily targeted Ukraine, utilizing...

Microsoft Warns Of Storm-0539’s Aggressive Gift Card Theft

Gift cards are attractive to hackers since they provide quick monetization for stolen data...

Kinsing Malware Attacking Apache Tomcat Server With Vulnerabilities

The scalability and flexibility of cloud platforms recently boosted the emerging trend of cryptomining...

NSA Releases Guidance On Zero Trust Maturity To Secure Application From Attackers

Zero Trust Maturity measures the extent to which an organization has adopted and implemented...

Chinese Hackers Stay Hidden On Military And Government Networks For Six Years

Hackers target military and government networks for varied reasons, primarily related to spying, which...

DNSBomb : A New DoS Attack That Exploits DNS Queries

A new practical and powerful Denial of service attack has been discovered that exploits...

Malicious PyPI & NPM Packages Attacking MacOS Users

Cybersecurity researchers have identified a series of malicious software packages targeting MacOS users.These...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Free Webinar

Live API Attack Simulation

94% of organizations experience security problems in production APIs, and one in five suffers a data breach. As a result, cyber-attacks on APIs increased from 35% in 2022 to 46% in 2023, and this trend continues to rise.
Key takeaways include:

  • An exploit of OWASP API Top 10 vulnerability
  • A brute force ATO (Account Takeover) attack on API
  • A DDoS attack on an API
  • Positive security model automation to prevent API attacks

Related Articles