Cisco closes holes in its Security Appliances

Network equipment manufacturer Cisco is warning of a critical vulnerability in its ASA 5500 Series Adaptive Security Appliances (ASA) that could be exploited by a remote, unauthenticated attacker to execute arbitrary code and compromise a victim's system. The problem is located in a Cisco port forwarding ActiveX control – distributed to client systems by ASA as part of the Clientless VPN feature – that can be used to cause a buffer overflow.

For an attack to be successful, a victim must first visit a specially crafted web page in Internet Explorer or another web browser that supports ActiveX technologies. Versions 7.1 and 7.2, as well as 8.0 to 8.6 of the Cisco ASA software are affected. Cisco has contacted Microsoft and requested that it set a global kill bit for the vulnerable control in a future update, which will disable the exploitable control on affected systems. The company has released software updates that address the issue; for those who can't yet upgrade, workarounds are provided in the Cisco security advisory.

Further updates from Cisco fix multiple denial-of-service (DoS) vulnerabilities in ASA 5500 Series appliances and the Catalyst 6500 Series ASA Services Module (ASASM). Another Protocol Independent Multicast (PIM) DoS hole has been closed in the Catalyst 6500 Series Firewall Services Module (FWSM).

(crve)