Cisco ASA Software DHCPv6 Relay Denial of Service Vulnerability

A vulnerability in the DHCPv6 relay feature of Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to cause an affected device to reload.

The vulnerability is due to insufficient validation of DHCPv6 packets. Cisco ASA Software is affected by this vulnerability only if the software is configured with the DHCPv6 relay feature. An attacker could exploit this vulnerability by sending crafted DHCPv6 packets to an affected device.

Note: Only DHCPv6 packets directed to the Cisco ASA
interface where the DHCPv6 relay feature is enabled can be used to trigger this
vulnerability. This vulnerability affects
systems configured in routed or transparent firewall mode and in single
or multiple
context mode. This vulnerability can be triggered only by IPv6 traffic.

This vulnerability is documented in Cisco bug ID CSCur45455[“https://bst.cloudapps.cisco.com/bugsearch/bug/CSCur45455”] (registered[“https://sec.cloudapps.cisco.comRPF/register/register.do”] customers only) and has been assigned CVE ID CVE-2015-0578.

Cisco has released software updates that address this vulnerability.
Workarounds that mitigate this vulnerability are not available.
This advisory is available at the following link:

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150115-asa-dhcp[“https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150115-asa-dhcp”]