topic Re: Vulnerability Scanning Mitigation needed in Network Security

Vulnerability Scanning Mitigation needed

Poo17 — Tue, 11 May 2021 03:04:08 GMT

Hello,

Can anyone please tell me the solution for mitigating the cisco ASA 5525 vulnerabilities?

FACTOR NAME

ISSUE TYPE TITLE

ISSUE TYPE CODE

Network Security	Certificate Without Revocation Control	tlscert_no_revocation
Network Security	Certificate Without Revocation Control	tlscert_no_revocation
Network Security	Certificate Lifetime Is Longer Than Best Practices	tlscert_excessive_expiration
Network Security	Certificate Lifetime Is Longer Than Best Practices	tlscert_excessive_expiration
Network Security	Certificate Signed With Weak Algorithm	tlscert_weak_signature
Network Security	Certificate Signed With Weak Algorithm	tlscert_weak_signature

Re: Vulnerability Scanning Mitigation needed

Marvin Rhoads — Tue, 11 May 2021 04:12:20 GMT

If the certificate in question is the identity certificate used by SSL VPN clients, then replace it with a proper certificate issued by a public CA.

Re: Vulnerability Scanning Mitigation needed

Poo17 — Tue, 11 May 2021 04:22:30 GMT

Hi Marvin,

Thank you for your reply. I am trying to decommission the SSL VPN because that service is not in use anymore. How can I do that?

Thank you!

Re: Vulnerability Scanning Mitigation needed

Marvin Rhoads — Tue, 11 May 2021 08:36:54 GMT

If you want to shut it down, you can just remove the service from the outside interface:

conf t
webvpn
disable outside <assuming that's your public interface name>
end
wr mem

There is more involved to thoroughly clean up the configuration but the first step will remove the certificate from being exposed to the vulnerability scanning.