05-25-2010 12:24 AM - edited 03-11-2019 10:50 AM
Dear All,
Our audit team has identified som vulnerbilities, which i am not able to understand.. need help if their queries are correct and these unwanted services can be blocked on ASA.
Queries:
The presence of the URI 'cart32.exe' has been discovered on the web server. This resource could potentially allow malicious individuals to compromise a web servers security through multiple exploit and attack vectors. This vulnerability could possibly lead to further compromise of the web server's integrity.
The presence of the URI 'ccbill/' has been discovered on the web server. This resource could potentially allow malicious individuals to compromise a web servers security through multiple exploit and attack vectors. This vulnerability could possibly lead to further compromise of the web server's integrity.
The presence of the URI 'ccbill2/' has been discovered on the web server. This resource could potentially allow malicious individuals to compromise a web servers security through multiple exploit and attack vectors. This vulnerability could possibly lead to further compromise of the web server's integrity.
The presence of the URI 'creditcards/' has been discovered on the web server. This resource could potentially allow malicious individuals to compromise a web servers security through multiple exploit and attack vectors. This vulnerability could possibly lead to further compromise of the web server's integrity.
Plez help if these services can be blocked..
Regards
Amar
05-25-2010 05:19 AM
Amar,
I assume that you have some kind of Webserver behind the ASA and you are scanning that Webserver's IP for vulnerabilities, correct? The ASA itself does not have anything remotely close to files like cart32/ccbill etc. Are you unable to simply remove those files/services from your webserver? If you cannot remove them from the webserver, we can use the ASA to block access attempts to anything on that webserver if the URI contains any of the keywords ccbill/cart32. Is that what you are looking to do?
05-30-2010 10:21 PM
Also this is found with the issue:
- with webvpn enabled on any port other then the default (443) the webvpn http server responds to the url http://
- you can change
Has anyone came across such issue and how can it lead to security attack.
06-15-2010 10:51 AM
yes..
regards
amar
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide