CVE-2018-15399
MediumCVSS 6.8Exploitation Probability (EPSS)
High risk77th percentile - higher than 77% of all known CVEs
Summary
A vulnerability in the TCP syslog module of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to exhaust 1550-byte buffers on an affected device, causing a DoS condition. The issue is due to a missing boundary check in an internal function. An attacker could exploit this by performing a man-in-the-middle attack between the device and its TCP syslog server and modifying TCP headers.
Risk Assessment
The risk includes disruption of all TCP-based features such as AnyConnect SSL VPN, clientless SSL VPN, and management connections, potentially impacting service availability.
Recommendation
It is recommended to upgrade ASA/FTD software to a patched version and monitor TCP syslog traffic for anomalies.
Original NVD description (English source)
A vulnerability in the TCP syslog module of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to exhaust the 1550-byte buffers on an affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to a missing boundary check in an internal function. An attacker could exploit this vulnerability by establishing a man-in-the-middle position between an affected device and its configured TCP syslog server and then maliciously modifying the TCP header in segments that are sent from the syslog server to the affected device. A successful exploit could allow the attacker to exhaust buffer on the affected device and cause all TCP-based features to stop functioning, resulting in a DoS condition. The affected TCP-based features include AnyConnect SSL VPN, clientless SSL VPN, and management connections such as Secure Shell (SSH), Telnet, and HTTPS.