CVE-2016-1445

Vulnerability

Cisco Adaptive Security Appliance (ASA) Software versions 8.2 through 9.4.3.3 contain an access control list (ACL) bypass vulnerability in the handling of ICMP echo reply messages [1]. The flaw stems from improper filtering of ICMP echo request subtypes when ACL rules are applied, allowing traffic that should be denied by security policies to be permitted [1].

Exploitation

An unauthenticated, remote attacker can exploit this vulnerability by sending crafted ICMP echo request traffic to an affected Cisco ASA device [1]. No authentication or special network position is required beyond network access to the device. The attack does not require user interaction.

Impact

Successful exploitation allows the attacker to bypass configured ACLs, resulting in ICMP traffic that should be blocked being allowed through the device [1]. This could enable information disclosure or network reconnaissance by allowing ping responses that would otherwise be denied.

Mitigation

Cisco released software updates to address this vulnerability in July 2016 [1]. There are no workarounds available. Users must upgrade to a fixed version (9.4.3.4 or later, depending on the release train). This vulnerability is not known to be listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.