News
Vigil@nce - Cisco Adaptive Security Appliance: lack of integrity check of IPsec flows
July 2015 by Vigil@nce
This bulletin was written by Vigil@nce : http://vigilance.fr/offer
SYNTHESIS OF THE VULNERABILITY
An attacker can change IPsec packets or inject new ones to be
handled by Cisco Adaptive Security Appliance, in order to corrupt
the plain text.
– Impacted products: ASA
– Severity: 1/4
– Creation date: 18/06/2015
DESCRIPTION OF THE VULNERABILITY
The Cisco Adaptive Security Appliance product can use the
cryptographic component Cavium Networks for checking the integrity
of the packet flow.
However, when the used algorithm is AES with the GCM mode, the
message authentication code is not verified.
An attacker can therefore change IPsec packets or inject new ones
to be handled by Cisco Adaptive Security Appliance, in order to
corrupt the plain text.
ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN
