Buffer overflow in the IKEv1 and IKEv2 implementations in Cisco ASA Software before 8.4(7.30), 8.7 before 8.7(1.18), 9.0 before 9.0(4.38), 9.1 before 9.1(7), 9.2 before 9.2(4.5), 9.3 before 9.3(3.7), 9.4 before 9.4(2.4), and 9.5 before 9.5(2.2) on ASA 5500 devices, ASA 5500-X devices, ASA Services Module for Cisco Catalyst 6500 and Cisco 7600 devices, ASA 1000V devices, Adaptive Security Virtual Appliance (aka ASAv), Firepower 9300 ASA Security Module, and ISA 3000 devices allows remote attackers to execute arbitrary code or cause a denial of service (device reload) via crafted UDP packets, aka Bug IDs CSCux29978 and CSCux42019.

A vulnerability in the Internet Key Exchange (IKE) version 1 (v1) and IKE version 2 (v2) code of Cisco ASA Software could allow an unauthenticated, remote attacker to cause a reload of the affected system or to remotely execute code. The vulnerability is due to a buffer overflow in the affected code area. An attacker could exploit this vulnerability by sending crafted UDP packets to the affected system. An attacker could exploit this vulnerability by sending crafted UDP packets to the affected system. Only traffic directed to the affected system can be used to exploit this vulnerability. This vulnerability affects systems configured in routed and transparent firewall mode and in single or multiple context mode. This vulnerability can be triggered by IPv4 and IPv6 traffic. A valid IKE phase 1 SA is not required to exploit this vulnerability.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

The remote Cisco Adaptive Security Appliance (ASA) or device running IOS / IOS XE is affected by one of the following vulnerabilities in the Internet Key Exchange (IKE) implementation :

  - An overflow condition exists in both the IKE and IKEv2     implementations due to improper validation of     user-supplied input when handling UDP packets. An     unauthenticated, remote attacker can exploit this issue,     via specially crafted UDP packets, to cause a buffer     overflow condition, resulting in a denial of service or     the execution of arbitrary code. (CVE-2016-1287)

  - A denial of service vulnerability exists in the IKEv2     implementation due to improper handling of fragmented     IKEv2 packets. An unauthenticated, remote attacker can     exploit this issue, via specially crafted UDP packets,     to cause the device to reload. (CVE-2016-1344)

The remote Cisco Adaptive Security Appliance (ASA) is missing a vendor-supplied security patch. It is, therefore, affected by a remote code execution vulnerability due to an overflow condition in the Internet Key Exchange (IKE) implementation. An unauthenticated, remote attacker can exploit this, via specially crafted UDP packets, to cause a denial of service or the execution of arbitrary code. Note that only systems configured in routed firewall mode and single / multiple context mode are affected.

ID	Name	Product	Family	Type	Severity
505548	Cisco ASA IKEv1/IKEv2 Buffer Overflow (CVE-2016-1287)	Tenable OT Security	Tenable.ot	Remote	critical
89033	Cisco ASA / IOS IKE Fragmentation Vulnerability	Nessus	CISCO	Remote	critical
88713	Cisco ASA Software IKEv1 and IKEv2 UDP Packet Handling RCE (cisco-sa-20160210-asa-ike)	Nessus	CISCO	Local	critical

Detections

Analytics

CVE-2016-1287

critical

Tenable Plugins

critical

critical

critical