Description Preview
A vulnerability in DNS over IPv6 packet processing for Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to unexpectedly reload, resulting in a denial of service (DoS) condition. The vulnerability is due to improper length validation of a field in an IPv6 DNS packet. An attacker could exploit this vulnerability by sending a crafted DNS query over IPv6, which traverses the affected device. An exploit could allow the attacker to cause the device to reload, resulting in a DoS condition. This vulnerability is specific to DNS over IPv6 traffic only.
Overview
CVE-2020-3191 affects Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software. The vulnerability is classified as CWE-20 (Improper Input Validation) and allows remote attackers to cause a denial of service condition by sending specially crafted IPv6 DNS packets. When exploited, the affected device will unexpectedly reload, disrupting network services. This vulnerability specifically impacts DNS traffic over IPv6, not IPv4, and can be exploited without authentication, making it particularly concerning for internet-facing deployments.
Remediation
To address this vulnerability, organizations should:
- Update to a fixed version of Cisco ASA or FTD software as recommended in the Cisco Security Advisory.
- If immediate patching is not possible, consider implementing one of these workarounds:
- Disable IPv6 DNS processing if not required in your environment
- Configure access control lists (ACLs) to filter IPv6 DNS traffic from untrusted sources
- Implement IPv6 traffic filtering at network boundaries to block potentially malicious IPv6 DNS packets
- Monitor system logs for unexpected device reloads that might indicate exploitation attempts
- Ensure proper network segmentation to limit exposure of affected devices
References
- Cisco Security Advisory: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-ipv6-67pA658k
- MITRE CWE-20 (Improper Input Validation): https://cwe.mitre.org/data/definitions/20.html
- National Vulnerability Database (NVD) entry for CVE-2020-3191
Industry ExposureMost to leastThis section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.
This section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.
- Health Care & Social AssistanceHealth Care & Social Assistance
- Public AdministrationPublic Administration
- Retail TradeRetail Trade
- Accommodation & Food ServicesAccommodation & Food Services
- Administrative, Support, Waste Management & Remediation ServicesAdministrative, Support, Waste Management & Remediation Services
- Agriculture, Forestry Fishing & HuntingAgriculture, Forestry Fishing & Hunting
- Arts, Entertainment & RecreationArts, Entertainment & Recreation
- ConstructionConstruction
- Educational ServicesEducational Services
- Finance and InsuranceFinance and Insurance
- InformationInformation
- Management of Companies & EnterprisesManagement of Companies & Enterprises
- ManufacturingManufacturing
- MiningMining
- Other Services (except Public Administration)Other Services (except Public Administration)
- Professional, Scientific, & Technical ServicesProfessional, Scientific, & Technical Services
- Real Estate Rental & LeasingReal Estate Rental & Leasing
- Transportation & WarehousingTransportation & Warehousing
- UtilitiesUtilities
- Wholesale TradeWholesale Trade
