topic OpenSSL version in IOS in Network Security

OpenSSL version in IOS

Wassim Aouadi — Fri, 21 Feb 2020 12:47:53 GMT

Hi networkers,

I recently run a pentest against a 2911 router. It mentioned the following message:

[quote]Vulnerability allows remote attackers to force the downgrade to an unintended cipher.

OpenSSL before 0.9.8q, and 1.0.x before 1.0.0c, when SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG is enabled, does not properly prevent modification of the ciphersuite in the session cache, which allows remote attackers to force the downgrade to an unintended cipher via vectors involving sniffing network traffic to discover a session identifier."

To fix the vulnerability update your software according to used platform. All necessary information is available here:
http://www.openssl.org/ "

[/quote]

Is there a way to detect the version of SSL implemented on a router?

Thanks,

Wass

OpenSSL version in IOS

mveedock — Thu, 21 Mar 2013 16:56:43 GMT

Wass,

When an IOS image is released, it is linked to a single OpenSSL version. If there is a specific IOS image you are concerned with, provide Cisco with the exact IOS image name, and we can return the OpenSSL version for that image to you.

However, if you are trying to find the OpenSSL version for an ASA (Adaptive Security Appliance), you can determine this version from the ASA release notes. Simply examine the "Open Source" notes that are located in the release notes of the particular ASA image you are concerned with. For example, from the ASA 8.4 release notes, you will find a section titled "Related Documentation", which has a link that points to "ASA Series Documentation". From there, you will find a link for "Open Source License". That will take you to an "Open Source" page which reveals that the OpenSSL version that runs on the ASA 8.4 code is "0.9.8f"

As a side note, you can determine the OpenSSL version running on a "client" computer by issuing the "ssh -v" command. For example, on my own Mac we can see that I'm running OpenSSL version 0.9.8r.

mveedock-mac:~ mikeveedock$ ssh -v cisco@10.1.1.1

OpenSSH_5.2p1, OpenSSL 0.9.8r 8 Feb 2011

Hope this helps!

Mike Veedock

VPN Engineer – Cisco Systems

Re: OpenSSL version in IOS

smanfre — Wed, 23 Aug 2017 08:41:16 GMT

what version of openSSL is used in c880data-universalk9-mz.152-4.M5.bin?