Cisco ASA Challenge-Response Tunnel Group Selection Bypass Vulnerability

A vulnerability in the authentication code of Cisco ASA Software could allow an authenticated, remote attacker to access resources of a VPN tunnel group.

The vulnerability is due to improper implementation of the tunnel group selection when a user authenticates to the remote access VPN via the challenge-response mechanism. This vulnerability may affect Cisco ASA configured to authenticate remote access VPN users via LDAP, RADIUS, TACACS+, and RSA if a challenge-response is needed for authentication. Cisco ASA Software configured for Clientless or AnyConnect SSL VPN is affected by this vulnerability.

An attacker could exploit this vulnerability by crafting a response to the Cisco ASA with a different tunnel group parameter. A successful exploit could allow the attacker to bypass the tunnel group restriction and authenticate to a different tunnel group than the one selected during the authentication phase. This could result in accessing a different set of resources.

Cisco has confirmed the vulnerability in a security notice and released software updates.

To exploit this vulnerability, an attacker must authenticate to the targeted device. This requirement would likely decrease the possibility of a successful exploit.

Cisco indicates through the CVSS score that functional exploit code exists; however, the code is not known to be publicly available.