Cisco Adaptive Security Appliance Software Filter and Inspect Overlap Denial of Service Vulnerability

A vulnerability in the inspection and filter features of the Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, remote attacker to cause the affected system to reload.

The vulnerability is due to an internal traffic loop condition that can be triggered when a received packet is matched for both filtering and inspection due to a configuration with overlapping traffic matching criteria (configuration is not supported). An attacker could exploit this vulnerability by sending a packet that would be matched by the incorrect configuration. An exploit could allow the attacker to trigger an affected system to crash, resulting in a denial of service (DoS) condition.

Cisco has confirmed the vulnerability in a security notice and released software updates.

To exploit this vulnerability, an attacker must know whether a targeted device has both filtering and inspection features enabled. Due to the additional required information, this may reduce the likelihood of a successful exploit.