Cisco Adaptive Security Appliance (ASA) SNMP Buffer Overflow Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-05-24
• EPSS: 88% chance of exploitation in the next 30 days (higher than 100% of CVEs)

[ Description ]Official description

Buffer overflow in Cisco Adaptive Security Appliance (ASA) Software through 9.4.2.3 on ASA 5500, ASA 5500-X, ASA Services Module, ASA 1000V, ASAv, Firepower 9300 ASA Security Module, PIX, and FWSM devices allows remote authenticated users to execute arbitrary code via crafted IPv4 SNMP packets, aka Bug ID CSCva92151 or EXTRABACON.

CISA: A buffer overflow vulnerability in the Simple Network Management Protocol (SNMP) code of Cisco ASA software could allow an attacker to cause a reload of the affected system or to remotely execute code.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 14 Jun 2022): Apply updates per vendor instructions.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• blogs.cisco.com/security/shadow-brokersExploitPress/Media CoverageVendor Advisory
• tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-asa-snmpVendor Advisory
• tools.cisco.com/security/center/viewErp.xVendor Advisory
• www.securityfocus.com/bid/92521Broken LinkNot ApplicableThird Party Advisory
• www.securitytracker.com/id/1036637Broken LinkThird Party AdvisoryVDB Entry
• github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/40258.zipBroken LinkExploit
• www.exploit-db.com/exploits/40258Third Party AdvisoryVDB Entry
• zerosum0x0.blogspot.com/2016/09/reverse-engineering-cisco-asa-for.htmlExploitTechnical Description
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource