topic Repeated ASA 5510 failed vulnerability scan (OpenSSL error) in Network Security

Repeated ASA 5510 failed vulnerability scan (OpenSSL error)

clippersbaseball — Mon, 11 Mar 2019 20:11:35 GMT

We are getting vulnerability scanned by a PCI company and keep getting failures that state "OpenSSL SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG". I've opened two TAC cases and TAC said that this vulnerability was addressed several versions back (we're currently running version 8.2.2 on our 5510 ASA). TAC made several small changes to attempt to address this issue but we keep failing with the same message. Has anyone ever failed their scan with this error and if so, what did you do to address this error?

Here is the detailed error:

OpenSSL SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG

Ciphersuite Change Issue

Synopsis :

The remote host allows resuming SSL sessions.

Description :

The version of OpenSSL on the remote host has been shown to allow

resuming session with a different cipher than was used when the

session was initiated. This means that an attacker that sees (e.g.

by sniffing) the start of an SSL connection can manipulate the OpenSSL

session cache to cause subsequent resumes of that session to use a

cipher chosen by the attacker.

Re: Repeated ASA 5510 failed vulnerability scan (OpenSSL error)

mirober2 — Mon, 04 Apr 2011 13:16:49 GMT

Hi John,

The Cisco bug ID filed to track this vulnerability is CSCtk61443. You can read the details here:

http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCtk61443

The vulnerability will be fixed in an upcoming release of 8.2.4.8. Please open up a TAC case to request this image for your ASA.

Hope that helps.

-Mike

Repeated ASA 5510 failed vulnerability scan (OpenSSL error)

Zubair.Sayed_2 — Wed, 20 Mar 2013 12:45:19 GMT

Hi Mike,

I seem to be having the same issue and I followed your bug and notice the bug says it has been fixed in version 8.2 (5).

We have an ASA 5520 and running Cisco Adaptive Security Appliance Software Version 8.2(5)2 and we conducted a Pen test recently and the company picked this error, see my thread below.

https://supportforums.cisco.com/thread/2206441?tstart=0

Thanks

- Zubair