Secunia

Amin Tora has reported a weakness in Cisco ASA (Adaptive Security Appliances), which can be exploited by malicious people to cause a DoS (Denial of Service).

The weakness is caused due to the ASA failover testing algorithm failing to properly identify that the active firewall has failed. The standby firewall performs failover tests by sending ARP requests for the active firewall's IP addresses. This can be exploited to prevent the standby firewall from activating via spoofed ARP responses. The failover may also fail to happen if there is another device with the same IP address as the active firewall on the same network subnet.

The weakness has been reported in ASA running 7.0(0), 7.0(2), and 7.0(4).

Solution
The vendor recommends that port security should be configured for all switch ports in the same VLANs as the active and standby firewalls enabled interfaces to prevent an attacker from spoofing the active firewall's interface MAC address.
Further details available in Customer Area

Provided and/or discovered by
Amin Tora, ePlus Security Team.

Changelog
Further details available in Customer Area

Deep Links
Links available in Customer Area