CVE-2015-6423

Vulnerability

The DCERPC Inspection implementation in Cisco Adaptive Security Appliance (ASA) Software versions 9.4.1 through 9.5.1 contains an internal ACL that is incorrectly programmed to allow all traffic types instead of being restricted to DCERPC traffic on TCP port 135. This allows traffic that is not DCERPC to bypass the intended ACL [1].

Exploitation

An authenticated remote attacker can send arbitrary network traffic between hosts that are configured for DCERPC inspection. The attacker only needs network access to the ASA and to be authenticated; no special position or race condition is required. The flawed ACL permits non-DCERPC traffic that would normally be dropped [1].

Impact

Successful exploitation allows the attacker to reach hosts that should be restricted by the ASA's DCERPC-only ACL. This effectively bypasses an intended access control rule, leading to unauthorized network access and potential information disclosure or further exploitation of the internal hosts [1].

Mitigation

Cisco has released software updates to address this vulnerability. No workarounds are available. Users should upgrade to a fixed Cisco ASA Software version as indicated in the vendor advisory. Systems running affected versions (9.4.1–9.5.1) remain vulnerable until patched [1].