Secunia Logo  
 
Cisco ASA Failover Denial of Service Weakness
Secunia Advisory: SA17550
Release Date: 2005-11-15
Last Update: 2005-12-07
Popularity: 8,840 views

Critical:
Not critical
Impact: DoS
Where: From local network
Solution Status: Vendor Workaround

OS:Cisco Adaptive Security Appliance (ASA) 7.x
Cisco PIX 7.x

Subscribe: Instant alerts on relevant vulnerabilities

CVE reference:CVE-2005-3788


Description:
Amin Tora has reported a weakness in Cisco ASA (Adaptive Security Appliances), which can be exploited by malicious people to cause a DoS (Denial of Service).

The weakness is caused due to the ASA failover testing algorithm failing to properly identify that the active firewall has failed. The standby firewall performs failover tests by sending ARP requests for the active firewall's IP addresses. This can be exploited to prevent the standby firewall from activating via spoofed ARP responses. The failover may also fail to happen if there is another device with the same IP address as the active firewall on the same network subnet.

The weakness has been reported in ASA running 7.0(0), 7.0(2), and 7.0(4).

Solution:
The vendor recommends that port security should be configured for all switch ports in the same VLANs as the active and standby firewalls enabled interfaces to prevent an attacker from spoofing the active firewall's interface MAC address.

The firewall log should also be monitored for any IP address collisions.

Provided and/or discovered by:
Amin Tora, ePlus Security Team.

Changelog:
2005-12-07: Added CVE reference.


Track this Secunia Advisory
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.

Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.

About this Secunia Advisory
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.

Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
  
Latest Advisories

Send Feedback to Secunia
If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com.

Ideas, suggestions, and other feedback are most welcome.

Most Popular - 3 Hours

1. Drupal Project Module File Upload and Cross-Site Scripting // 101 views
2. Advanced Poll Multiple Vulnerabilities // 77 views
3. SAP GUI TabOne ActiveX Control Caption List Buffer Overflow // 74 views
4. Symantec Mail Security for SMTP Response Handling Denial of Service // 60 views
5. SmbFTPD Long Command Processing Vulnerability // 56 views
6. Debian update for iceape // 46 views
7. Internet Explorer Data Binding Memory Corruption Vulnerability // 42 views
8. Cisco Global Site Selector DNS Request Denial of Service // 40 views
9. Drupal Project Issue Tracking Module Multiple Vulnerabilities // 39 views
10. Lasso OpenSSL "DSA_verify()" Spoofing Vulnerability // 38 views