Cisco Warns of Second Firewall Bug Exposed by Shadow Brokers

Cisco is scrambling to patch another vulnerability in many of its products that were exposed as part of the Shadow Brokers dump last month. The latest vulnerability affects many different products, including all of the Cisco PIX firewalls.
The latest weakness lies in the code that Cisco’s IOS operating system uses to process IKEv1 packets. IKE is used in the IPSec protocol to help set up security associations, and Cisco uses it in a number of its products. The company said in an advisory that many versions of its IOS operating system are affected, including IOS XE and XR.
“A vulnerability in IKEv1 packet processing code in Cisco IOS, Cisco IOS XE, and Cisco IOS XR Software could allow an unauthenticated, remote attacker to retrieve memory contents, which could lead to the disclosure of confidential information,” the advisory says.
“The vulnerability is due to insufficient condition checks in the part of the code that handles IKEv1 security negotiation requests. An attacker could exploit this vulnerability by sending a crafted IKEv1 packet to an affected device configured to accept IKEv1 security negotiation requests. A successful exploit could allow the attacker to retrieve memory contents, which could lead to the disclosure of confidential information.”
Cisco does not have patches available for this vulnerability yet and said there are no workarounds available to protect against attacks either. Many of the products affected by this flaw are older releases and are no longer supported, specifically the PIX firewalls, which haven’t been supported since 2009.
This is the second time in the last month that Cisco has warned customers about a vulnerability that was disclosed in the Shadow Brokers release. In August, the company discovered that the toolset released by the anonymous group included an exploit for a vulnerability in the SNMP implementation in its ASA and PIX firewalls.
“The vulnerability is due to a buffer overflow in the affected code area. An attacker could exploit this vulnerability by sending crafted SNMP packets to the affected system. An exploit could allow the attacker to execute arbitrary code and obtain full control of the system or to cause a reload of the affected system. The attacker must know the SNMP community string to exploit this vulnerability,” that advisory says.
Cisco didn’t say when a patch would be available for the latest vulnerability and acknowledged that an exploit for the flaw is publicly known.
Image from Flickr stream of Cisco Systems GmbH.