topic Re: CVE-2004-0230 detected - Fixed firmware for ASA 5506? in Network Security

CVE-2004-0230 detected - Fixed firmware for ASA 5506?

MarcoLazzarotto — Mon, 23 Jan 2023 16:20:33 GMT

Hello,

a vulnerability test detected "TCP Sequence Number Approximation Based Denial of Service" vulnerability (CVE-2004-0230) on a ASA 5506.

The ASA should be running on 9.8(2).

How do I find when (what firmware version) Cisco fixed the vulnerability?

Re: CVE-2004-0230 detected - Fixed firmware for ASA 5506?

balaji.bandi — Mon, 23 Jan 2023 16:45:35 GMT

Product is EOL - (you need to uplift to latest models - Cisco Secure firewalls (aka FTD)

https://www.cisco.com/c/en/us/products/collateral/security/asa-5500-series-next-generation-firewalls/eos-eol-notice-c51-744797.html

Re: CVE-2004-0230 detected - Fixed firmware for ASA 5506?

MarcoLazzarotto — Mon, 23 Jan 2023 17:06:36 GMT

I understand. Would I be able to fix the issue by updating to latest available firmware?

Re: CVE-2004-0230 detected - Fixed firmware for ASA 5506?

balaji.bandi — Mon, 23 Jan 2023 17:14:10 GMT

where do you get latest firmware and product not sold or giving support by Cisco ?

Re: CVE-2004-0230 detected - Fixed firmware for ASA 5506?

Marvin Rhoads — Mon, 23 Jan 2023 17:41:11 GMT

I'd be surprised if this is a true positive alert since the CVE (from 2004) was identified 11 years before the ASA 5506 was first released (in 2015). The last software released for the ASA 5506 was 9.16(4)9 in November 2022.

Re: CVE-2004-0230 detected - Fixed firmware for ASA 5506?

MarcoLazzarotto — Mon, 23 Jan 2023 17:54:06 GMT

@Marvin Rhoads , I'm not gonna lie, I was waiting for a confirm about this. The CVE is indeed from 2004.

Thank you