--- licence_title: Creative Commons Attribution 4.0 International (CC-BY 4.0) licence_link: https://creativecommons.org/licenses/by/4.0/ licence_restrictions: https://cert.europa.eu/legal-notice licence_author: CERT-EU, The Cybersecurity Service for the European Union institutions, bodies, offices and agencies title: 'Multiple Severe Vulnerabilities in Cisco Products' version: '1.0' number: '2021-058' date: 'October 29, 2021' --- _History:_ * _29/10/2021 --- v1.0 -- Initial publication_ # Summary On October 27, Cisco released multiple security fixes about vulnerabilities affecting their products, including nine with a high CVSS score. These vulnerabilities affect the open source Snort3 project, Adaptive Security Appliance (ASA), Firepower Threat Defense (FTD) and Firepower Management Center software (FMC) [1]. # Technical Details ## CVE-2021-40116 - Snort Rule Denial of Service Vulnerability This vulnerability with a CVSS score of 8.6 out of 10 affects multiple Cisco products running Snort3 releases earlier than `Release 3.1.0.100`, configured with `Block with Reset` or `Interactive Block with reset` actions. It is due to improper handling of these actions, if one of the rules is not configured with proper constraints. A remote, unauthenticated attackers could exploit this vulnerability by sending a crafted IP packet to the products running Snort3 that will cause traffic to be dropped (DoS condition). [2] This vulnerability does not affect Snort2 configurations and the following products: - Adaptive Security Appliance (ASA) Software - 1000 Series Integrated Services Routers (ISRs) - 4000 Series Integrated Services Routers (ISRs) - Catalyst 8000V Edge Software - Catalyst 8200 Series Edge Platforms - Catalyst 8300 Series Edge Platforms - Catalyst 8500 Series Edge Platforms - Catalyst 8500L Series Edge Platforms - Cloud Services Router 1000V Series - Firepower Management Center (FMC) Software - Integrated Services Virtual Router (ISRv) - Meraki Security Appliances ### Workaround Cisco proposes to change the Snort inspection engine from Snort3 to Snort2, or change all rule actions with `Block with Reset` or `Interactive block with Reset` to another action. Another Workaround proposed by Cisco consists in changing the firewall reset rule by narrowing the configuration rule, or by setting up the application or the protocol. ## CVE-2021-34783 - ASA and FTD Software-Based SSL/TLS Denial of Service Vulnerability This vulnerability with a CVSS score of 8.6 out of 10 affects ASA and FTD software, allowing an unauthenticated, remote attacker to cause a Denial of Service condition. This is due to insufficient validation of SSL/TLS messages when the device performs software-based SSL/TLS decryption. To exploit this vulnerability, an attacker could craft and send an SSL/TLS message to an affected device, causing the reload and the DoS condition. [3] ## CVE-2021-34781 - FTD SSH Connections Denial of Service Vulnerability This vulnerability with a CVSS score of 8.6 out of 10 affects FTD software, allowing a unauthenticated, remote attacker to cause a Denial of Service condition on the device. This is due to the lack of proper error handling when an SSH session fails to be established. To exploit the vulnerability, an attacker could send a high rate of crafted SSH connections to the device, causing a resource exhaustion, and at the same time, a Denial of Service condition on the device, which should be reloaded to recover [4]. ## CVE-2021-34752/CVE-2021-34755/CVE-2021-34756 - FTD Command Injection Vulnerabilities These vulnerabilities with a CVSS score of 7.8 out of 10 affect the Cisco FTD software, allowing an authenticated, local attacker to execute arbitrary commands with root privileges. This is due to multiple vulnerabilities in the CLI of Cisco FTD Software, more precisely to insufficient validation of user-supplied command arguments. To exploit this vulnerability, an attacker could submit a crafted input to execute command with root privileges on the underlying operating system. [8] Depending on the configuration of the device running the vulnerable release, it might be affected by distinct CVEs: |Cisco FTD Configuration | Associated CVE IDs | |--------------------------|------------------| |Multi-instance | CVE-2021-34755 and CVE-2021-34756 | |Default |CVE-2021-34752| ## CVE-2021-34762 - FMC Authenticated Directory Traversal Vulnerability This vulnerability with a CVSS score of 8.1 out of 10 affects FMC software, allowing an authenticated, remote attacker to perform directory traversal attack. It is due to insufficient input validation of the HTTPS URL by the web-based management interface. To exploit this vulnerability, an attacker could send crafted HTTPS request that contains directory traversal character sequence, allowing the attacker to read or write arbitrary files on the device. [5] ## CVE-2021-40117 - ASA and FTD SSL/TLS Denial of Service Vulnerability This vulnerability with a CVSS score of 8.6 out of 10 affects ASA and FTD software, and allows an unauthenticated, remote attacker to cause a Denial of Service condition. It exists because incoming SSL/TLS packets are not properly processed. To exploit this vulnerability, an attacker could craft and send an SSL/TLS message to an affected device, causing the reload and the DoS condition of it. [6] ## CVE-2021-1573/CVE-2021-34704/CVE-2021-40118 - ASA and FTD Web Services Denial of Service Vulnerabilities These vulnerabilities with a CVSS score of 8.6 out of 10 affects ASA and FTD software, and allow an unauthenticated, remote attacker to cause a Denial of Service condition. This is due to improper input validation when parsing HTTPS requests. To exploit this vulnerability, an attacker could send malicious HTTPS request to an affected device, leading to the reload of the device, causing a Denial of Service [7]. ## CVE-2021-34792 - ASA and FTD Resource Exhaustion Denial of Service Vulnerability This vulnerability with a CVSS score of 8.6 affects ASA and FTD software, and allows an unauthenticated, remote attacker to cause a Denial of Service condition. This is due to improper resource management when connection rates are high. To exploit this vulnerability, an attacker could open a significant number of connections on an affected device, leading to the reload of the device, causing a Denial of Service condition [9]. ## CVE-2021-34793 - ASA and FTD Transparent Mode Denial of Service Vulnerability This vulnerability with a CVSS score of 8.6 affects ASA and FTD software, allowing an unauthenticated, remote attacker to cause a Denial of Service condition. It is due to incorrect handling of certain TCP segments when the affected device is operating in transparent mode. To exploit this vulnerability, an attacker could send a crafted TCP segment through an affected device, allowing the attacked to poison the MAC address tables in adjacent devices, resulting in network disruption [10]. # Affected Products and Fixed Releases - Cisco ASA Software | Cisco ASA Software Release | Fixed Release for All Vulnerabilities Described in the Advisory | |---------------|-----------------| |9.7 and earlier |Migrate to a fixed release.| |9.8 | 9.8.4.40| |9.9 | Migrate to a fixed release.| |9.10| Migrate to a fixed release.| |9.12| 9.12.4.29| |9.13| Migrate to a fixed release.| |9.14| 9.14.3.9| |9.15| 9.15.1.17| |9.16| 9.16.2.3| - Cisco FTD Software |Cisco FTD Software Release | Fixed Release for All Vulnerabilities Described in the Advisory | |----|---| |6.2.2 and earlier| Migrate to a fixed release.| |6.2.3 |Migrate to a fixed release.| |6.3.01 |Migrate to a fixed release.| |6.4.0 | 6.4.0.13 (Nov 2021)| |6.5.0| Migrate to a fixed release.| |6.6.0| 6.6.5.1 (Nov 2021)| |6.7.0| 6.7.0.3 (Jan 2022)| |7.0.0| 7.0.1| # Recommendations To fix all these vulnerabilities, CERT-EU and Cisco highly recommend updating each release to the last version, when possible, or to upgrade the release. # References [1] [2] [3] [4] [5] [6] [7] [8] [9] [10]