CVE-2018-0101

Cisco ASA - Crash (PoC)

Severity Score

10.0

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

A vulnerability in the Secure Sockets Layer (SSL) VPN functionality of the Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to cause a reload of the affected system or to remotely execute code. The vulnerability is due to an attempt to double free a region of memory when the webvpn feature is enabled on the Cisco ASA device. An attacker could exploit this vulnerability by sending multiple, crafted XML packets to a webvpn-configured interface on the affected system. An exploit could allow the attacker to execute arbitrary code and obtain full control of the system, or cause a reload of the affected device. This vulnerability affects Cisco ASA Software that is running on the following Cisco products: 3000 Series Industrial Security Appliance (ISA), ASA 5500 Series Adaptive Security Appliances, ASA 5500-X Series Next-Generation Firewalls, ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers, ASA 1000V Cloud Firewall, Adaptive Security Virtual Appliance (ASAv), Firepower 2100 Series Security Appliance, Firepower 4110 Security Appliance, Firepower 9300 ASA Security Module, Firepower Threat Defense Software (FTD). Cisco Bug IDs: CSCvg35618.

Una vulnerabilidad en la funcionalidad VPN Secure Sockets Layer (SSL) de Cisco Adaptive Security Appliance (ASA) podría permitir que un atacante remoto no autenticado provoque la recarga del sistema afectado o que ejecute código de forma remota. La vulnerabilidad se debe a un intento de doble liberación (double free) de una región de memoria cuando la característica webvpn está habilitada en el dispositivo Cisco ASA. Un atacante podría explotar esta vulnerabilidad enviando múltiples peticiones XML manipuladas a la interfaz configurada por webvpn en el sistema afectado. Un exploit podría permitir que el atacante ejecute código arbitrario y obtenga control total del sistema, o que provoque una recarga del dispositivo afectado. Esta vulnerabilidad afecta a las versiones de Cisco ASA Software que se ejecutan en los siguientes productos de Cisco: 3000 Series Industrial Security Appliance (ISA), ASA 5500 Series Adaptive Security Appliances, ASA 5500-X Series Next-Generation Firewalls, ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers, ASA 1000V Cloud Firewall, Adaptive Security Virtual Appliance (ASAv), Firepower 2100 Series Security Appliance, Firepower 4110 Security Appliance, Firepower 9300 ASA Security Module y Firepower Threat Defense Software (FTD). Cisco Bug IDs: CSCvg35618.

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

Complete

Integrity

Complete

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2017-11-27 CVE Reserved
2018-01-29 CVE Published
2018-02-07 First Exploit
2024-07-25 EPSS Updated
2024-08-05 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-415: Double Free

CAPEC

References (7)

URL	Tag	Source
http://www.securityfocus.com/bid/102845	Third Party Advisory
http://www.securitytracker.com/id/1040292	Third Party Advisory
https://icanthackit.wordpress.com/2018/01/30/thoughts-on-the-handling-cve-2018-0101-cisco-bug-cscvg35618	Third Party Advisory

URL	Date	SRC
https://www.exploit-db.com/exploits/43986	2024-08-05
https://github.com/1337g/CVE-2018-0101-DOS-POC	2018-02-07
https://pastebin.com/YrBcG2Ln	2024-08-05

URL	Date	SRC

URL	Date	SRC
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180129-asa1	2023-08-15

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Cisco Search vendor "Cisco"		Adaptive Security Appliance Software Search vendor "Cisco" for product "Adaptive Security Appliance Software"				< 9.1.7.23 Search vendor "Cisco" for product "Adaptive Security Appliance Software" and version " < 9.1.7.23"		-		Affected
Cisco Search vendor "Cisco"		Adaptive Security Appliance Software Search vendor "Cisco" for product "Adaptive Security Appliance Software"				>= 9.2.0 < 9.2.4.27 Search vendor "Cisco" for product "Adaptive Security Appliance Software" and version " >= 9.2.0 < 9.2.4.27"		-		Affected
Cisco Search vendor "Cisco"		Adaptive Security Appliance Software Search vendor "Cisco" for product "Adaptive Security Appliance Software"				>= 9.3.0 < 9.4.4.16 Search vendor "Cisco" for product "Adaptive Security Appliance Software" and version " >= 9.3.0 < 9.4.4.16"		-		Affected
Cisco Search vendor "Cisco"		Adaptive Security Appliance Software Search vendor "Cisco" for product "Adaptive Security Appliance Software"				>= 9.5.0 < 9.6.4.3 Search vendor "Cisco" for product "Adaptive Security Appliance Software" and version " >= 9.5.0 < 9.6.4.3"		-		Affected
Cisco Search vendor "Cisco"		Adaptive Security Appliance Software Search vendor "Cisco" for product "Adaptive Security Appliance Software"				>= 9.7.0 < 9.7.1.21 Search vendor "Cisco" for product "Adaptive Security Appliance Software" and version " >= 9.7.0 < 9.7.1.21"		-		Affected
Cisco Search vendor "Cisco"		Adaptive Security Appliance Software Search vendor "Cisco" for product "Adaptive Security Appliance Software"				>= 9.8.0 < 9.8.2.20 Search vendor "Cisco" for product "Adaptive Security Appliance Software" and version " >= 9.8.0 < 9.8.2.20"		-		Affected
Cisco Search vendor "Cisco"		Adaptive Security Appliance Software Search vendor "Cisco" for product "Adaptive Security Appliance Software"				>= 9.9.0 < 9.9.1.2 Search vendor "Cisco" for product "Adaptive Security Appliance Software" and version " >= 9.9.0 < 9.9.1.2"		-		Affected
Cisco Search vendor "Cisco"		Firepower Threat Defense Search vendor "Cisco" for product "Firepower Threat Defense"				6.0.0 Search vendor "Cisco" for product "Firepower Threat Defense" and version "6.0.0"		-		Affected
Cisco Search vendor "Cisco"		Firepower Threat Defense Search vendor "Cisco" for product "Firepower Threat Defense"				6.0.1 Search vendor "Cisco" for product "Firepower Threat Defense" and version "6.0.1"		-		Affected
Cisco Search vendor "Cisco"		Firepower Threat Defense Search vendor "Cisco" for product "Firepower Threat Defense"				6.1.0 Search vendor "Cisco" for product "Firepower Threat Defense" and version "6.1.0"		-		Affected
Cisco Search vendor "Cisco"		Firepower Threat Defense Search vendor "Cisco" for product "Firepower Threat Defense"				6.2.0 Search vendor "Cisco" for product "Firepower Threat Defense" and version "6.2.0"		-		Affected
Cisco Search vendor "Cisco"		Firepower Threat Defense Search vendor "Cisco" for product "Firepower Threat Defense"				6.2.1 Search vendor "Cisco" for product "Firepower Threat Defense" and version "6.2.1"		-		Affected
Cisco Search vendor "Cisco"		Firepower Threat Defense Search vendor "Cisco" for product "Firepower Threat Defense"				6.2.2 Search vendor "Cisco" for product "Firepower Threat Defense" and version "6.2.2"		-		Affected