TLS Session Renegotiation Vulnerability

Krishna Kumar konduri — Tue, 12 Mar 2019 02:34:29 GMT

Hi Team,

We are trying to scan the ASA firewall and getting the below error. Is there any way to resolve this issue? Please sugget.

We did a security scan of Internal firewall and found one issue - "TLS

Session Renegotiation Vulnerability"

The TLS protocol, and the SSL protocol 3.0 and possibly earlier, does

not properly associate renegotiation handshakes with an existing

connection, which allows man-in-the-middle attackers to insert data into

HTTPS sessions, and possibly other types of sessions protected by TLS or

SSL, by sending an unauthenticated request that is processed

retroactively by a server in a post-renegotiation context, related to a

"plaintext injection" attack

Michael Muenz — Fri, 06 Sep 2013 13:08:04 GMT

It would be easier to search for a solution if theres a CVE ID available.

Perhaps it's solved with Interim 9.1.2?

Michael

Please rate all helpful posts

Re: TLS Session Renegotiation Vulnerability

mersnetadmin — Wed, 24 Oct 2018 15:44:40 GMT

I believe the CVE is CVE-2009-3555