PT-2020-4706 · Cisco · Cisco Ftd+1

Published 2020-10-21 · Updated 2023-08-16 · CVE-2020-3555

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions: Cisco Adaptive Security Appliance (ASA) Software (affected versions not specified) Cisco Firepower Threat Defense (FTD) Software (affected versions not specified)

Description: The issue is related to errors in resource release in the implementation of the SIP protocol in the software of Cisco Firepower Threat Defense (FTD) and Cisco Adaptive Security Appliance (ASA) firewalls. Exploitation of this issue could allow a remote attacker to cause a denial of service by sending crafted SIP traffic. The vulnerability is due to a watchdog timeout and crash during the cleanup of threads associated with a SIP connection being deleted. An attacker could exploit this by sending a high rate of crafted SIP traffic, potentially causing a crash and reload of the affected device.

Recommendations: For Cisco Adaptive Security Appliance (ASA) Software, update to a fixed release as recommended by Cisco. For Cisco Firepower Threat Defense (FTD) Software, update to a fixed release as recommended by Cisco. As a temporary workaround, consider restricting access to the SIP inspection process to minimize the risk of exploitation.

Fix

DoS

Improper Resource Release

Weakness Enumeration

CWE-404

Related Identifiers

BDU:2020-05258

CVE-2020-3555

Affected Products

Cisco Asa

Cisco Ftd

References · 5

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-sipdos-3DGvdjvg · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-3555 · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-sipdos-3DGvdjvg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-3555 · Security Note
• https://bdu.fstec.ru/vul/2020-05258 · Security Note