Cisco ASA/FTD OSPF Memory Leak Vulnerability (CVE-2020-3195) Advisory

Vulnerability Key Information Vulnerability Title: Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software OSPF Packets Processing Memory Leak Vulnerability Vulnerability Level: High CVE Number: CVE-2020-3195 Initial Release Date: May 6, 2020, 16:00 GMT Last Update Date: June 2, 2020, 20:45 GMT CVSS Base Score: 8.6 Cisco Bug ID: CSCvr92168 Vulnerability Overview The vulnerability exists in the Open Shortest Path First (OSPF) implementation within Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software. An unauthenticated remote attacker could exploit this vulnerability to cause a memory leak on affected devices. This vulnerability arises from improper handling of certain OSPF packets. An attacker can exploit it by sending a series of carefully crafted OSPF packets to the affected device. Successful exploitation may allow the attacker to continuously consume memory on the affected device, eventually causing it to reload and resulting in a Denial of Service (DoS) condition. Affected Products This vulnerability affects Cisco ASA Software or Cisco FTD Software configured to support OSPF routing and with Link-Local Signaling (LLS) block processing enabled. LLS block processing is enabled by default. Other products confirmed to be unaffected: Cisco Firepower Management Center (FMC) Software. Solution Cisco has released free software updates to address the vulnerability described in this advisory. There are two methods to determine whether OSPF routing is configured on an ASA device. No workaround is available for this vulnerability. Cisco ASA Software versions 9.5 and earlier, as well as version 9.7, have reached end-of-software-maintenance. Customers are advised to migrate to a supported version that includes the fix for this vulnerability. Fixed Versions Patched versions of Cisco ASA Software and Cisco FTD Software, along with the list of releases containing the fix for this vulnerability, are provided in the documentation.

Goal Reached Thanks to every supporter — we hit 100%!

Cisco ASA/FTD OSPF Memory Leak Vulnerability (CVE-2020-3195) Advisory