Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Low-Entropy Keys Vulnerability
Cisco · Cisco Adaptive Security Appliance (ASA) Software
A vulnerability in the Deterministic Random Bit Generator (DRBG), also known as Pseudorandom Number Generator (PRNG), used in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a cryptographic collision, enabling the attacker to discover the private key of an affected device. The vulnerability is due to insufficient entropy in the DRBG when generating cryptographic keys. An attacker could exploit this vulnerability by generating a large number of cryptographic keys on an affected device and looking for collisions with target devices. A successful exploit could allow the attacker to impersonate an affected target device or to decrypt traffic secured by an affected key that is sent to or from an affected target device.
- Exploited
- Not confirmed
- Reports
- 0
- Tactics
- 7/15
How an attack unfolds
Based on MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. mappings. Select a step to see the evidence.Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
Disclosed on 3 May 2019. No public exploit code or confirmed exploitation is recorded.
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
4 TechniqueOne specific attacker behaviour in MITRE ATT&CK, such as T1190 “Exploit Public-Facing Application”. IDs with a dot, like T1059.004, are sub-techniques., grouped by TacticThe attacker’s goal at a stage of an attack in MITRE ATT&CK, such as Initial Access or Persistence. Each technique belongs to one or more tactics. in kill-chain order 4Initial AccessTA0001
Credential AccessTA0006
Detection
0 rules for this CVE · 100 general rules for its techniquesRules for this CVE
0Sigma ruleAn open, vendor-neutral detection rule for log data. Security teams convert Sigma rules into searches for their own SIEM. that reference CVE-2019-1715 directly.CVE-specific rules are not available in this build. Search SigmaHQ ↗
General rules for this CVE’s techniques
These detect the technique in general, not this specific vulnerability.
Brute ForceT111025 general rules
- External Remote SMB Logon from Public IPhightest
- Hack Tool User Agenthightest
- HackTool - CrackMapExec Executionhightest
- HackTool - Hydra Password Bruteforce Executionhightest
- Password Spray Activityhightest
- Potential MFA Bypass Using Legacy Client Authenticationhightest
- Sign-in Failure Due to Conditional Access Requirements Not Methightest
- Use of Legacy Authentication Protocolshightest
Valid AccountsT107856 general rules
- Win Susp Computer Name Containing Samtheadmincriticaltest
- Account Created And Deleted Within A Close Time Framehightest
- Activity From Anonymous IP Addresshightest
- Atypical Travelhightest
- Azure AD Threat Intelligencehightest
- Azure Subscription Permission Elevation Via AuditLogshightest
- External Remote SMB Logon from Public IPhightest
- Impossible Travelhightest
Network SniffingT10409 general rules
- Cisco Sniffingmediumtest
- Harvesting Of Wifi Credentials Via Netsh.EXEmediumtest
- New Network Trace Capture Started Via Netsh.EXEmediumtest
- PktMon.EXE Executionmediumtest
- Potential Network Sniffing Activity Using Network Toolsmediumtest
- Potential Packet Capture Activity Via Start-NetEventSession - ScriptBlockmediumtest
- Windows Pcap Driversmediumtest
- Network Sniffing - Linuxlowtest
Adversary-in-the-MiddleT155710 general rules
- Suspicious Child Process of Notepad++ Updater - GUP.Exehighexperimental
- Uncommon File Created by Notepad++ Updater Gup.EXEhighexperimental
- Potential Suspicious Activity Using SeCEditmediumtest
- ISATAP Router Address Was Setmediumexperimental
- Notepad++ Updater DNS Query to Uncommon Domainsmediumexperimental
- Cisco BGP Authentication Failureslowtest
- Cisco LDP Authentication Failureslowtest
- Huawei BGP Authentication Failureslowtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.