Cisco VPN ASA Bug

Cisco has warned customers using its Adaptive Security Appliance (ASA) software to patch a dangerous VPN bug that a researcher will be revealing how to exploit this weekend.

Cisco's ASA operating system for its network security devices has a severe double-free vulnerability in the Secure Sockets Layer VPN feature that it warns "could allow an unauthenticated, remote attacker to cause a reload of the affected system or to remotely execute code".

A successful attack using multiple, specially crafted XML packets would allow an attacker to take "full control of the system", according to Cisco's advisory.

Due to the ease of exploitation and the impact, the bug -- CVE-2018-010 -- has been given a Common Vulnerability Score System (CVSS) score of 10 out of a possible 10.

is there a fix for this?

Yes. Available from Cisco download.

or

You can disable webadmin till you are able/ready to apply the patch.

If I run a Nessus scan, would i be able to pick up this vulnerability?

Not sure.

Researcher will be revealing and share how to exploit this weekend.

Believe they are using XML scripts to take full control over the system.

IS a definitely a serious bug.

searchsecurity.techtarget.com/news/25243...ainst-remote-attacks