topic Re: FTD 4120 Vulnerability in Network Security

FTD 4120 Vulnerability

ChristopherO — Fri, 21 Feb 2020 16:30:18 GMT

Hello!

During a vulnerability scan on my FTD 4120, I was provided with the below vulnerability to resolve. Can you tell me if 4120 has enabled the H2 protocol?

Vulnerability description:

Apache HTTPD: DoS for HTTP/2 connections by continuous SETTINGS (CVE-2018-11763)
By sending continous SETTINGS frames of maximum size an ongoing HTTP/2 connection could be kept busy and would never time out. This can be abused for a DoS on the server. This only affect a server that has enabled the h2 protocol.

Re: FTD 4120 Vulnerability

Abheesh Kumar — Mon, 26 Nov 2018 18:24:39 GMT

Hi,

Apache Remote Web Server is affected by multiple vulnerabilities on the FXOS Version 2.3(1.73)

CSCvj48872 it is fixed on the version 2.3(1.88) & 2.3(1.82)

Multiple Common Vulnerability and Exposures ID's CVE-2017-15710, CVE-2017-15715, CVE-2018-1283, CVE-2018-1301, CVE-2018-1302, CVE-2018-1303,
CVE-2018-1312

HTH

Abheesh

Re: FTD 4120 Vulnerability

ChristopherO — Mon, 26 Nov 2018 19:40:21 GMT

Thanks for the quick response Abheesh,

The FXOS version installed is 2.3(1.88) and I plan to upgrade to 2.3(1.56) soon.

The Vulnerability has Exposures ID of CVE-2018-11763 listed which i didn't see listed below. If I am running FXOS 2.3(1.88) and the scan still is reporting the vulnerability, what should i do to resolve this, or should it be marked as a false positive?

Thanks for your help!

Chris

Re: FTD 4120 Vulnerability

Abheesh Kumar — Mon, 26 Nov 2018 20:49:50 GMT

Hi,
Are you planning to downgrade...??? I think its recommended to upgrade to latest version.
As per the bug CSCvj48872, its fixed on the mentioned releases but in your case as per the vulnerability scan its still affected, my suggestion is to open a ticket with cisco for further more verification/analysis.

HTH
Abheesh