====================================================================


                             CERT-Renater

                 Note d'Information No. 2018/VULN155
_____________________________________________________________________

DATE                : 19/04/2018

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Cisco AnyConnect Secure Mobility
                       Client, Cisco ASA Software, Cisco FTD Software.

=====================================================================
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-asaanyconnect
_____________________________________________________________________

Cisco Security Advisory: Cisco ASA Software, FTD Software, and
AnyConnect Secure Mobility Client SAML Authentication Session Fixation
Vulnerability

Advisory ID: cisco-sa-20180418-asaanyconnect

Revision: 1.0

For Public Release: 2018 April 18 16:00 GMT

Last Updated: 2018 April 18 16:00 GMT

CVE ID(s): CVE-2018-0229

CVSS Score v(3): 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

+---------------------------------------------------------------------

Summary

=======

A vulnerability in the implementation of Security Assertion Markup
Language (SAML) Single Sign-On (SSO) authentication for Cisco AnyConnect
Secure Mobility Client for Desktop Platforms, Cisco Adaptive Security
Appliance (ASA) Software, and Cisco Firepower Threat Defense (FTD)
Software could allow an unauthenticated, remote attacker to establish an
authenticated AnyConnect session through an affected device running ASA
or FTD Software. The authentication would need to be done by an
unsuspecting third party.

The vulnerability exists because there is no mechanism for the ASA or
FTD Software to detect that the authentication request originates from
the AnyConnect client directly. An attacker could exploit this
vulnerability by persuading a user to click a crafted link and
authenticating using the company's Identity Provider (IdP). A successful
exploit could allow the attacker to  hijack a valid authentication token
and use that to establish an authenticated AnyConnect session through an
affected device running ASA or FTD Software.

Cisco has released software updates that address this vulnerability.
There are no workarounds that address this vulnerability.

This advisory is available at the following link:

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-asaanyconnect

["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-asaanyconnect"]

==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================