🇰🇷 한글 설명
Cisco ASA 5510, 5520, 5525-X 등 다양한 모델에서 NAT 변환 주소에 대한 ARP/GARP 요청 출처를 검증하지 않는 취약점입니다. 공격자는 ARP 스푸핑을 통해 트래픽을 가로채거나 중간자 공격을 수행할 수 있습니다.
💡 쉬운 설명
Cisco 방화벽이 '정말 그 주소에서 온 건가' 확인하지 않아서, 공격자가 거짓 주소로 위장할 수 있습니다. 이를 통해 네트워크 통신을 도청하거나 변조할 수 있습니다.
🇺🇸 원문 (English)
ASA 5515-X Adaptive Security Appliance Adaptive Security Appliance (ASA) Software 9.4.x before 9.4.1 Interim, 9.2.x before 9.2.4 Interim, ASA 5510 Adaptive Security Appliance Adaptive Security Appliance (ASA) Software 8.4.x before 8.4.7 Interim, 8.2.x before 8.2.5 Interim, 9.1.x before 9.1.6 Interim, ASA 5555-X Adaptive Security Appliance ASA for Application Centric Infrastructure (ACI) Device Package 1.2.4.x before 1.2.4.8, ASA 5512-X Adaptive Security Appliance ASA for Application Centric Infrastructure (ACI) Device Package 1.2.4.x before 1.2.4.8, ASA 5520 Adaptive Security Appliance Adaptive Security Appliance (ASA) Software 8.2.x before 8.2.5 Interim, 8.4.x before 8.4.7 Interim, 9.1.x before 9.1.6 Interim, ASA 5505 Adaptive Security Appliance Adaptive Security Appliance (ASA) Software 9.2.x before 9.2.4 Interim, 8.4.x before 8.4.7 Interim, 9.1.x before 9.1.6 Interim, ASA 5525-X Adaptive Security Appliance ASA for Application Centric Infrastructure (ACI) Device Package 1.2.4.x before 1.2.4.8, ASA 5512-X Adaptive Security Appliance Adaptive Security Appliance (ASA) Software 9.4.x before 9.4.1 Interim, 9.2.x before 9.2.4 Interim or 9.2.4.SMP, 9.1.x before 9.1.6 Interim, ASA 5545-X Adaptive Security Appliance ASA for Application Centric Infrastructure (ACI) Device Package 1.2.4.x before 1.2.4.8, ASA 5585-X Adaptive Security Appliance ASA for Application Centric Infrastructure (ACI) Device Package 1.2.4.x before 1.2.4.8, ASA 5540 Adaptive Security Appliance Adaptive Security Appliance (ASA) Software 8.2.x before 8.2.5 Interim, 8.4.x before 8.4.7 Interim, 9.1.x before 9.1.6 Interim, ASA 5515-X Adaptive Security Appliance ASA for Application Centric Infrastructure (ACI) Device Package 1.2.4.x before 1.2.4.8, ASA 5555-X Adaptive Security Appliance Adaptive Security Appliance (ASA) Software 9.2.x before 9.2.4 Interim or 9.2.4.SMP, 9.4.x before 9.4.1 Interim, 9.1.x before 9.1.6 Interim, ASA 5580 Adaptive Security Appliance Adaptive Security Appliance (ASA) Software 9.1.x before 9.1.6 Interim, ASA 5585-X Adaptive Security Appliance Adaptive Security Appliance (ASA) Software 9.2.x before 9.2.4 Interim, 9.4.x before 9.4.1 Interim, ASA 5525-X Adaptive Security Appliance Adaptive Security Appliance (ASA) Software 9.4.x before 9.4.1 Interim, 9.2.x before 9.2.4 Interim or 9.2.4.SMP, 9.1.x before 9.1.6 Interim, ASA 5545-X Adaptive Security Appliance Adaptive Security Appliance (ASA) Software 9.4.x before 9.4.1 Interim, 9.2.x before 9.2.4 Interim or 9.2.4.SMP. 9.1.x before 9.1.6 ASA does not check the source of the ARP request or GARP packets for addresses it performs NAT translation for under unspecified conditions.
📍 영향받는 시스템
Cisco ASA 5505/5510/5520/5525-X/5540/5545-X/5555-X/5580/5585-X 펌웨어 8.2.x, 8.4.x, 9.1.x, 9.2.x, 9.4.x 취약 버전
⚔️ 공격 벡터
ARP 스푸핑으로 NAT 변환 주소 출처 위조하여 트래픽 가로채기 또는 중간자 공격(MITM) 수행
🛡️ 대응 방법
ASA 펌웨어를 9.4.1 Interim, 9.2.4 Interim, 9.1.6 Interim, 8.4.7 Interim, 8.2.5 Interim 이상으로 업그레이드
🔧 검증 코드
System Software Version이 8.2.5, 8.4.7, 9.1.6, 9.2.4, 9.4.1 Interim 미만이면 취약, 해당 버전 이상이면 패치됨
ssh admin@[ASA_IP] 'show version' | grep 'System Software Version'
📊 CVSS Vector String
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
💻 영향받는 소프트웨어
Cisco Email Security Appliance