CVE-2019-15992: 
Cisco Adaptive Security Appliance (ASA) vulnerability analysis and mitigation

A critical vulnerability (CVE-2019-15992) was discovered in the Lua interpreter implementation integrated within Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software. The vulnerability was first published on November 12, 2019, and received a CVSS base score of 7.2 (High). This security flaw affects multiple versions of Cisco ASA Software and Cisco FTD Software, potentially exposing organizations to remote code execution attacks (Cisco Advisory).

The vulnerability stems from insufficient restrictions on allowed Lua function calls within the context of user-supplied Lua scripts. In ASA Software, the issue exists in the Dynamic Access Policy (DAP) feature that allows administrators to create policies using the Lua programming language. For FTD Software, the vulnerability is present in the Custom Application Detectors feature, specifically in the Advanced Detectors that use custom Lua files. The vulnerability is classified as CWE-787 (Out-of-bounds Write) and has been assigned a CVSS v3.1 base score of 7.2 (High) with the vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H (NVD).

A successful exploitation of this vulnerability could allow an authenticated, remote attacker to execute arbitrary code with root privileges on the underlying Linux operating system of an affected device. The attacker could trigger a heap overflow condition, leading to complete system compromise with the highest privileges (Cisco Advisory).

The Cisco Product Security Incident Response Team (PSIRT) confirmed that proof-of-concept exploit code is available for this vulnerability. However, successful exploitation requires valid administrative credentials. As of the last update, Cisco PSIRT was not aware of any malicious use of this vulnerability in the wild (Cisco Advisory).

Cisco has released software updates to address this vulnerability. For ASA Software, fixed versions include 9.6.4.36, 9.8.4.15, 9.9.2.61, 9.10.1.32, 9.12.3, 9.13.1.4, 9.14.2.7, and 9.15.1.4. For FTD Software, the complete fix requires both VDB Update 329 and specific FMC hotfixes. No workarounds are available for this vulnerability, making it critical for affected users to apply the appropriate software updates (Cisco Advisory).