ASA5512 Failing PCI compliance CVE-2016-2183

[murraymwps]

Does anyone have any ideas on a workaround for failing CVE-2016-2183. Cisco published the vulnerability back in September but hasn't come up with a workaround or fix.

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160927-openssl

I'm running an ASA 5512 ver 9.3(2). We've failed PCI compliance twice now.

thanks,

-mike

[Oliver Kaiser]

There is no workaround at the moment. Internal development builds seem to be fixed, but there has been no update on when fixed releases will be released.

To keep track of this you might wanna subscribe to the bug CSCvb48640

[murraymwps]

Looks like a fix has just been released but I can't find these software versions to download. From the bug search page:

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvb48640?emailclick=CNSemail

...the following are known fixed releases:

9.1(7.12)

97.1(0.95)

97.1(0.96)

97.1(12.8)

97.1(6.43)

98.1(1.15)

98.1(1.16)

98.1(10.16)

98.1(11.3)

98.1(2.26)

98.1(2.27)

I can't see where to download 97.x or 98.x. I see 9.6 as the highest version. Are these typos?

[Oliver Kaiser]

Those are internal development builds. We will have to wait for QA to finish testing before they are being released.