ASA 9.4; HOW TO VERIFY OPENSSL VERSION

[M Mohammed]

Hi all,

how can i review what version of OPENSSL is being used and is it safe or need an upgrade.

Many thanks

MM

[Ken Stieers]

Check the "Open source used in Cisco ASA..." docs on their site

Here is the one for 9.4.1

https://www.cisco.com/c/dam/en/us/td/docs/security/asa/asa94/license/open-source/Cisco_ASA_Series_941.pdf

The latest suggested release is 9.4.4, at the very least you want 9.4(4)5 (has fix for CSCvd78303)

[M Mohammed]

Hi Ken,

Many thanks for the information.

could you please advise how i can verify by using CLI or ASDM on asa what version of OpenSSL is being used and is that the correct version, and if not how to upgrade it.

Best regards,

MM

[Ken Stieers]

You can't do it that way.

You check the version of ADSM/ASA and go to the documentation.

[M Mohammed]

Many thanks Ken

[M Mohammed]

Hi Ken,

this is the below report we have got for pen test

OpenSSL was outdated. A suitably placed attacker may be able to decrypt or forge SSL messages by telling the service to begin encrypted communications before key material has been exchanged, which causes predictable keys to be used for future communications. SSL-Session: Protocol
Update the OpenSSL encryption library to the latest available version. Tools such as NMAP (using the script ‘-p- --script=ssl-ccs-injection’) may be used to verify this issue.

what procedure should i follow to comply with this issue

Please advise

Many thanks

MM

[Ken Stieers]

2 things: ask pen tester exactly what vulnerability they are hitting

Then open TAC case to get Cisco to give you the right version of ASA code...

You might want to ask this in the ASA forum... you're posting in Email security

[M Mohammed · Accepted solution]

resolved the issue, had to upgrade the ios to 9.8.

[oreastri]

Hello,

Just run this command from cli 

openssl version

openssl version –help