Threat Level: green Handler on Duty: Jan Kopriva

SANS ISC: Cisco ASA SNMP Remote Code Execution Vulnerability SANS ISC InfoSec Forums

Watch ISC TV. Great for NOCs, SOCs and Living Rooms: https://isctv.sans.edu

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Cisco ASA SNMP Remote Code Execution Vulnerability

Looking back through all the vulnerabilities announced this week, one caught my eye. CVE-2016-6366 is a vulnerability in the Cisco ASA products which could allow a remote attacker to remotely execute code. This vulnerability is part of the Equation Group disclosures and was not previously known by Cisco. The vulnerability is in the SNMP code on the ASA and would allow an attacker with knowledge of the SNMP community string to send crafted IPv4 SNMP traffic which could be used to reload the system or possibly exploit the system to gain control.

The likelihood of being able to exploit this is low for those of us who have deployed in a secure manner:  

- management interfaces not exposed to hostile networks

- SNMP strings set to a secure value (non-default!)

- etc. 

But for those of you who have needed to deploy Cisco ASA in a less than optimal configuration, you may want to keep an eye on this one.  

As always the answer is "patch soon"!

There is a snort rule to detect the attempted exploitation of this vulnerability (Snort Rule ID: 3:39885).

See CCIRC or Cisco's announcement for more details

 

-- Rick Wanner MSISE - rwanner at isc dot sans dot edu - http://namedeplume.blogspot.com/ - Twitter:namedeplume (Protected)

Rick

294 Posts
ISC Handler
Better safe than sorry, and there's no such thing as a secure SNMP Community string, and most will have deployed Cisco ASA in "less optimal configurations" (AKA real life) so better doublecheck everything?

/Martin
Anonymous

Sign Up for Free or Log In to start participating in the conversation!