Attackers target SIP flaws in Cisco firewalls to overload devices

There are no patches or workarounds available for two software bugs found last week

hacking

Malicious actors are exploiting a Session Initiation Protocol-related (SIP) vulnerability in two Cisco products to trigger high CPU usage and take a system offline.

SIP is a signalling protocol used to set up and maintain real-time sessions, such as audio or video calls, online. The flaws, which are the result of incorrect handling of SIP traffic, can be exploited by an attacker "sending SIP requests designed to specifically trigger this issue at a high rate", according to the networking giant.

Advertisement - Article continues below

If exploited correctly, it could cause an affected device to reload, or trigger high CPU usage, leading to a denial-of-service (DoS).

The bug has been found in Cisco's Adaptive Security Appliance (ASA) and Firepower Threat Defence (FTD) software running on a host of Cisco's physical and virtual appliances. These include the 3000 Series Industrial Security Appliance, Adaptive Security Virtual Appliance, and Firepower 9300 ASA Security Module.

The vulnerability is being exploited if the output of 'show conn port 5060' (where port 5060 on a router is normally reserved for SIP traffic) shows a large number of incomplete SIP connections, and CPU usage is high.

Users can determine whether their software is affected by running the 'show version' command on the UI, with the bug found in ASA version 9.4 or FTD version 6.0 and above.

Advertisement
Advertisement - Article continues below

Other affected appliances include ASA 5500-X Series Next-Generation Firewalls, ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers, Adaptive Security Virtual Appliance (ASAv), Firepower Series 2100 and 4100 Series Security Appliance, and FTD Virtual (FTDv).

Advertisement - Article continues below

Cisco has said there are no patches available for the bug disclosed last week, nor any workarounds, with mitigation the only option for organisations affected. The company has set out four options for customers who may be under attack.

Disabling SIP inspection altogether will completely close the attack vector - but could break SIP connections. Blocking traffic from a specific IP address, presumed to be that of an attacker, meanwhile can be done using an access control list (ACL).

Users could also apply a filter on a 0.0.0.0 sent-by address since Cisco has seen offending traffic set to this invalid value, or implementing a rate limit on SIP traffic.

The networking giant's products and services are no stranger to abuse, with attackers previously exploiting a vulnerability in up to 168,000 unpatched IoT devices earlier this year to leave political messages.

Cisco first acknowledged the flaws through its Technical Services Advantage (TSA) technical support service, and says it will update its advisory should any patches be made available.

Featured Resources

Successful digital transformations are future ready - now

Research findings identify key ingredients to complete your transformation journey

Download now

Cyber security for accountants

3 ways to protect yourself and your clients online

Download now

The future of database administrators in the era of the autonomous database

Autonomous databases are here. So who needs database administrators anymore?

Download now

The IT expert’s guide to AI and content management

Your guide to the biggest opportunities for IT teams when it comes to AI and content management

Download now
Advertisement

Recommended

Visit/security/cyber-security/355267/zoom-hires-ex-facebook-cso-to-boost-platform-security
cyber security

Zoom hires ex-Facebook CSO Alex Stamos to boost platform security

8 Apr 2020
Visit/security/vulnerability/355236/hp-support-assistant-flaws-leave-windows-devices-open-to-attack
vulnerability

HP Support Assistant flaws leave Windows devices open to attack

6 Apr 2020
Visit/security/cyber-security/355234/safari-bug-let-hackers-access-cameras-on-iphones-and-macs
cyber security

Safari bug let hackers access cameras on iPhones and Macs

6 Apr 2020
Visit/software/video-conferencing/355229/zoom-we-moved-too-fast
video conferencing

Zoom CEO admits company "moved too fast" as privacy issues mount

6 Apr 2020

Most Popular

Visit/mobile/mobile-phones/355239/microsofts-patent-design-reveals-a-mobile-device-with-a-third-screen
Mobile Phones

Microsoft patents a mobile device with a third screen

6 Apr 2020
Visit/server-storage/servers/355254/a-critical-flaw-in-350000-microsoft-exchange-remains-unpatched
servers

A critical flaw in 350,000 Microsoft Exchange remains unpatched

7 Apr 2020
Visit/software/video-conferencing/355257/taiwan-first-country-to-ban-zoom-amid-security-concerns
video conferencing

Taiwan becomes first country to ban Zoom amid security concerns

8 Apr 2020