Secunia Security Advisory - Amin Tora has reported a weakness in Cisco ASA (Adaptive Security Appliances), which can be exploited by malicious people to cause a DoS (Denial of Service). The weakness is caused due to the ASA failover testing algorithm failing to properly identify that the active firewall has failed. The standby firewall performs failover tests by sending ARP requests for the active firewall's IP addresses. This can be exploited to prevent the standby firewall from activating via spoofed ARP responses. The failover may also fail to happen if there is another device with the same IP address as the active firewall on the same network subnet. The weakness has been reported in ASA running 7.0(0), 7.0(2), and 7.0(4).
0d1639aba1d7aa19dffa7ea920fe1f0db9aca7d53b5fcd19be30ba0ce4f44bfd
TITLE:
Cisco ASA Failover Denial of Service Weakness
SECUNIA ADVISORY ID:
SA17550
VERIFY ADVISORY:
http://secunia.com/advisories/17550/
CRITICAL:
Not critical
IMPACT:
DoS
WHERE:
>From local network
OPERATING SYSTEM:
Cisco ASA 5500 Series Adaptive Security Appliances
http://secunia.com/product/6115/
Cisco PIX 7.x
http://secunia.com/product/6102/
DESCRIPTION:
Amin Tora has reported a weakness in Cisco ASA (Adaptive Security
Appliances), which can be exploited by malicious people to cause a
DoS (Denial of Service).
The weakness is caused due to the ASA failover testing algorithm
failing to properly identify that the active firewall has failed. The
standby firewall performs failover tests by sending ARP requests for
the active firewall's IP addresses. This can be exploited to prevent
the standby firewall from activating via spoofed ARP responses. The
failover may also fail to happen if there is another device with the
same IP address as the active firewall on the same network subnet.
The weakness has been reported in ASA running 7.0(0), 7.0(2), and
7.0(4).
SOLUTION:
The vendor recommends that port security should be configured for all
switch ports in the same VLANs as the active and standby firewalls
enabled interfaces to prevent an attacker from spoofing the active
firewall's interface MAC address.
The firewall log should also be monitored for any IP address
collisions.
PROVIDED AND/OR DISCOVERED BY:
Amin Tora, ePlus Security Team.
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------