CVE-2020-3259 in cisco secure firewall threat defense
Exploitation of this CVE does not show up in logs, so there is no detection rule for it.
What the vulnerability is
A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to retrieve memory contents on an affected device, which could lead to the disclosure of confidential information. The vulnerability is due to a buffer tracking issue when the software parses invalid URLs that are requested from the web services interface. An attacker could exploit this vulnerability by sending a crafted GET request to the web services interface. A successful exploit could allow the attacker to retrieve memory contents, which could lead to the disclosure of confidential information. Note: This vulnerability affects only specific AnyConnect and WebVPN configurations. For more information, see the Vulnerable Products section.
Affected software: cisco secure firewall threat defense, cisco adaptive security appliance software
Scores
- CVSS: 7.5 (high)
- EPSS: 71.50% chance of exploitation in the next 30 days
- CISA KEV: Known exploited, listed 2024-02-15, used in ransomware
- Published: 2020-05-06
What LogPulse has for it
- Detection rule: No
- Agent check (vulnerable version): No
- Mitigation: Yes, see below
How to mitigate it
Upgrade Cisco ASA and FTD for the web services memory leak (CVE-2020-3259)
Patch or upgrade. The fixed ASA and FTD releases stop the AnyConnect/WebVPN web services from leaking heap memory such as WebVPN session cookies, usernames and certificates, which ransomware groups (Akira) used to log in to the VPN. Cisco offers no workaround, so upgrading is the only fix.
Applies to: Cisco ASA Software before 9.6.4.41, 9.8.4.20, 9.9.2.67, 9.10.1.40, 9.12.3.9, 9.13.1.10 (and all 9.5-and-earlier and 9.7 releases), and Cisco FTD Software 6.2.2 to before 6.2.3.16, 6.3.0.6, 6.4.0.9, 6.5.0.5, with AnyConnect SSL VPN, Clientless SSL VPN or AnyConnect IKEv2 client services enabled.
- Find exposed devices: on every ASA run show running-config webvpn and show running-config crypto ikev2; the device is in scope when webvpn is enabled on an interface or crypto ikev2 enable <if> client-services is set. On FTD, check Devices > VPN > Remote Access in FMC (or Device > Remote Access VPN in FDM).
- Run show version (ASA) or show version in the FTD CLI to read the running release.
- ASA: upgrade to at least the first fixed release of your train: 9.6.4.41, 9.8.4.20, 9.9.2.67, 9.10.1.40, 9.12.3.9 or 9.13.1.10. 9.14 and later are not affected. Releases 9.5 and earlier and 9.7 are end of maintenance: migrate to a supported fixed train.
- FTD: upgrade to at least 6.2.3.16, 6.3.0.6, 6.4.0.9 or 6.5.0.5 (or apply the matching Cisco_FTD_Hotfix package listed in the advisory). 6.6.0 and later are not affected; releases before 6.2.3 must migrate. Install through FMC or FDM and reapply the access control policy afterwards.
- Because memory may already have leaked: clear active VPN sessions (vpn-sessiondb logoff all) after the upgrade, and rotate passwords of VPN users, local ASA accounts and the LDAP/RADIUS service accounts the device uses.
- Turn on multi-factor authentication for remote access VPN so leaked usernames and passwords alone are not enough to log in.
- Review AnyConnect session logs (syslog 113039, 722022, 722051) since February 2024 for logins from unusual countries or hosting providers and investigate them.
Sources:
Source data: NIST NVD, CISA KEV and FIRST EPSS. LogPulse processes new CVEs every hour.
We build every detection with great care, but no two environments are the same. Log sources, parsing and configuration differ, so test a detection in your own environment before you rely on it.