The remote Cisco Adaptive Security Appliance (ASA) is missing a vendor-supplied security patch. It is, therefore, affected by a remote code execution vulnerability due to an overflow condition in the Internet Key Exchange (IKE) implementation. An unauthenticated, remote attacker can exploit this, via specially crafted UDP packets, to cause a denial of service or the execution of arbitrary code. Note that only systems configured in routed firewall mode and single / multiple context mode are affected.

The remote Cisco Adaptive Security Appliance (ASA) or device running IOS / IOS XE is affected by one of the following vulnerabilities in the Internet Key Exchange (IKE) implementation :

  - An overflow condition exists in both the IKE and IKEv2     implementations due to improper validation of     user-supplied input when handling UDP packets. An     unauthenticated, remote attacker can exploit this issue,     via specially crafted UDP packets, to cause a buffer     overflow condition, resulting in a denial of service or     the execution of arbitrary code. (CVE-2016-1287)

  - A denial of service vulnerability exists in the IKEv2     implementation due to improper handling of fragmented     IKEv2 packets. An unauthenticated, remote attacker can     exploit this issue, via specially crafted UDP packets,     to cause the device to reload. (CVE-2016-1344)

The remote Cisco Adaptive Security Appliance (ASA) is missing a vendor-supplied security patch. It is, therefore, affected by a remote code execution vulnerability due to an overflow condition in the Internet Key Exchange (IKE) implementation. An unauthenticated, remote attacker can exploit this, via a specially crafted UDP packet, to cause a denial of service or the execution of arbitrary code. Note that only systems configured in routed firewall mode and single / multiple context mode are affected.

ID	Name	Product	Family	Published	Updated	Severity
88713	Cisco ASA Software IKEv1 and IKEv2 UDP Packet Handling RCE (cisco-sa-20160210-asa-ike)	Nessus	CISCO	2/12/2016	11/26/2019	critical
89033	Cisco ASA / IOS IKE Fragmentation Vulnerability	Nessus	CISCO	2/29/2016	6/12/2020	critical
801951	Cisco ASA < 9.2(4.5) IKEv1 and IKEv2 UDP Packet Handling RCE (cisco-sa-20160210-asa-ike)	Log Correlation Engine	Generic	2/12/2016		critical
801954	Cisco ASA < 9.5(2.2) IKEv1 and IKEv2 UDP Packet Handling RCE (cisco-sa-20160210-asa-ike)	Log Correlation Engine	Generic	2/12/2016		critical
801948	Cisco ASA < 8.7(1.18) IKEv1 and IKEv2 UDP Packet Handling RCE (cisco-sa-20160210-asa-ike)	Log Correlation Engine	Generic	2/12/2016		critical
801953	Cisco ASA < 9.4(2.4) IKEv1 and IKEv2 UDP Packet Handling RCE (cisco-sa-20160210-asa-ike)	Log Correlation Engine	Generic	2/12/2016		critical
801949	Cisco ASA < 9.0(4.38) IKEv1 and IKEv2 UDP Packet Handling RCE (cisco-sa-20160210-asa-ike)	Log Correlation Engine	Generic	2/12/2016		critical
801952	Cisco ASA < 9.3(3.7) IKEv1 and IKEv2 UDP Packet Handling RCE (cisco-sa-20160210-asa-ike)	Log Correlation Engine	Generic	2/12/2016		critical
801946	Cisco ASA < 8.4(7.30) IKEv1 and IKEv2 UDP Packet Handling RCE (cisco-sa-20160210-asa-ike)	Log Correlation Engine	Generic	2/12/2016		critical
801947	Cisco ASA 8.6 IKEv1 and IKEv2 UDP Packet Handling RCE (cisco-sa-20160210-asa-ike)	Log Correlation Engine	Generic	2/12/2016		critical
801950	Cisco ASA < 9.1(7) IKEv1 and IKEv2 UDP Packet Handling RCE (cisco-sa-20160210-asa-ike)	Log Correlation Engine	Generic	2/12/2016		critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical