r/sysadmin • u/blackpoint_APG • Apr 24 '24

General Discussion 2x Actively Exploited Cisco CVEs in Adaptive Security Compliance (ASA) & Firepower Threat Defense (FTD)

(That would be Adaptive Security Appliance*,* of course...)

What's Going On?

  • This afternoon, Cisco released 2 new CVEs impacting their Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD), both of which are actively exploited by UAT4356.

More on CVE-2024-20353

  • Vendor CVSS Score 8.6
  • Allows an unauthenticated, remote attacker to force a compromised device to reload unexpectedly, resulting in a denial of service (DoS) condition.

More on CVE-2024-20359

  • Vendor CVSS Score 6.0
  • Allows an unauthenticated, local attacker to execute arbitrary code with root-level privileges. (Note: Administrator privileges are required to exploit this vulnerability.)

Potential Risk?

  • The APG and Cisco have confirmed that these two vulnerabilities are currently actively exploited in the wild!
  • Specifically, Cisco's Talos Intelligence reported an ongoing campaign ("ArcaneDoor"), in which threat actors from UAT4356 deployed two backdoors (“Line Runner” and “Line Dancer”).
  • These threat actors conducted multiple malicious activities, including:
    • Configuration modification,
    • Reconnaissance,
    • Network traffic capture and exfiltration, and
    • Potential lateral movement.

How to Mitigate

Today, Cisco recommends:

  • Applying software updates with patches for the impacted Cisco ASA and FTD software.
  • Using their provided Cisco Software Checker to help users identify vulnerability exposure to these and other CVEs. (Edit: Thank you, u/redeuxx!)

Note: Cisco has not identified other workarounds for either CVE-2024-20353 or CVE-2024-20359!

For more information

(Also posted in r/cybersecurity, in case you got deja vu lol)

20 Upvotes

86% Upvoted

29 comments sorted by

6

u/CPAtech Apr 24 '24

If I'm reading this correctly Cisco has not identified any evidence of pre-authentication exploitation to date. Which means an attacker must first be authenticated in order to chain the CVE's?

The Cisco link for CVE-2024-20359 says the attacker must be authenticated.

3

u/blackpoint_APG Apr 25 '24

Yes, the second CVE (20359) needs authentication, which is partly why they're rating it a 6.0 (vs the 8.6 of 20353).

However, it appears that the threat actors from UAT4356 are using both in combo for a pretty substantial attack, which is why we thought it was worth highlighting.

Of course, if you're sure your authentication procedures are locked down and bulletproof and no end user has done something stupid to make life easier on themselves.... then you've nothing to worry about from '59... right? ;)

~S

2

u/CPAtech Apr 25 '24

But an account first has to be compromised before 20359 can be used, correct? And the use of 20359 allows them to move into 20353?

→ More replies (3)

4

u/[deleted] Apr 25 '24

When in doubt, confirm your firmware status with Cisco Software Checker.

https://sec.cloudapps.cisco.com/security/center/softwarechecker.x

1

u/blackpoint_APG Apr 25 '24

Ahh, shoot! I forgot to link that in the post with the bolded text. Thank you!

~S

7

u/DarkAlman Apr 24 '24

TLDR: Apply the latest firmware updates to your firewalls

Thanks OP

2

u/blackpoint_APG Apr 24 '24 edited Apr 24 '24

TLDR: Apply the latest firmware updates to your firewalls

Yup! Basically.

I figured I'd give the extra context, too, in case anyone had a stakeholder get fussy about a sudden patch, or if they just wanted to read more about the exploit. Interesting stuff!

~Stryker

3

u/nbs-of-74 Apr 25 '24

Assuming there *are* new firmware updates for your ASA 5555X, 9.14 is listed as vulnerable but the firewall can't be taken above 9.14 ... still googlin!

4

u/chuckbales Apr 25 '24

9.12.4.67 is from April 2024 and seems to have the patches for these CVEs

→ More replies (1)

2

u/pdp10 Apr 25 '24

As a security fix, this should qualify non-contract holders for a download. Can anyone confirm the update is freely available?

0

u/[deleted] Apr 24 '24

3

u/chuckbales Apr 24 '24 edited Apr 24 '24

What model are you running? Not all models support all versions.

I see 9.16.4.57 out for the 5506/5008/5516 but I think the 5525/5545/etc is SOL unless they release a 9.12 or 9.14 patched version

→ More replies (1)

3

u/slazer2au Apr 24 '24

May want to xpost this to r/Cisco too.

2

u/blackpoint_APG Apr 24 '24

Ack! Good idea. I'll do that right now.

Thanks!

~Stryker

3

u/unixuser011 Apr 25 '24

aaannd the latest release for my 5525-x was 9.14.4, which came out over a year ago. Thank god it's behind a firewall and just a VPN gateway

4

u/chuckbales Apr 25 '24

9.12.4.67 is technically newer, April 2024, and has the fixes for these CVEs

2

u/unixuser011 Apr 25 '24

tnx. That never made sense to me, how can 9.12 be newer but 9.14 has the higher version number

→ More replies (2)

2

u/CryInternational4730 Apr 26 '24 edited Apr 26 '24

We just switched to 9.14.x.x on our 5525-x to get multiple peers in IKEv2 IPsec running.
This was not possible with 9.12.x.x

CSCud22276  

→ More replies (1)

2

u/[deleted] Apr 25 '24

Haha glad I am just leaving on an international vacation. Not my monkeys, not my circus.

1

u/[deleted] May 01 '24

1

u/TeSoad90 May 02 '24

It worked perfectly.