CVE-2014-0655

Vulnerability

The vulnerability resides in the Identity Firewall (IDFW) functionality of Cisco Adaptive Security Appliance (ASA) Software. It allows an unauthenticated remote attacker to alter the user-cache contents by replaying crafted RADIUS Change of Authorization (CoA) messages. The issue is tracked as Cisco bug ID CSCuj45332 [1]. Affected versions include certain releases of Cisco ASA Software, but exact version ranges are not specified in the available references.

Exploitation

An attacker with network access to a vulnerable ASA can send a crafted RADIUS CoA message. By capturing and replaying legitimate CoA messages or crafting new ones, the attacker can modify the user-cache entries. No authentication is required, as the ASA improperly validates the CoA messages. The attack does not require user interaction.

Impact

Successful exploitation allows the attacker to change the user-cache contents, which can lead to bypass of identity-based access controls. This may enable unauthorized network access or privilege escalation, compromising the confidentiality and integrity of network traffic policies enforced by IDFW.

Mitigation

Cisco released a Security Notice for this vulnerability [1]. The advisory recommends upgrading to a fixed software version, but the specific fixed version is not disclosed in the provided references. Workarounds include implementing RADIUS CoA message filtering or restricting access to the ASA management interface. No known public exploits or KEV listing at the time of publication.