Hi, we have just upgraded our Cisco Pix to a Cisco ASA 5520. I ran a security scan against the ASA's Outside IP and it came back with 2 vulnerabilities which I've pasted below. Should these be picked externally if not what should I check?
SSL Certificate - Self-Signed Certificate
THREAT:
An SSL Certificate associates an entity (person, organization, host, etc.) with a Public Key. In an SSL connection, the client authenticates the remote server using the server's Certificate and extracts the Public Key in the Certificate to establish the secure connection.
The client can trust that the Server Certificate belongs the server only if it is signed by a mutually trusted third-party Certificate Authority (CA). Self-signed certificates are created generally for testing purposes or to avoid paying third-party CAs. These should not be used on any production or critical servers.
By exploiting this vulnerability, an attacker can impersonate the server by presenting a fake self-signed certificate. If the client knows that the server does not have a trusted certificate, it will accept this spoofed certificate and communicate with the remote server.
IMPACT:
By exploiting this vulnerability, an attacker can launch a man-in-the-middle attack.
SOLUTION:
Please install a server certificate signed by a trusted third-party Certificate Authority.
SSL Certificate - Signature Verification Failed Vulnerability
THREAT:
An SSL Certificate associates an entity (person, organization, host, etc.) with a Public Key. In an SSL connection, the client authenticates the remote server using the server's Certificate and extracts the Public Key in the Certificate to establish the secure connection. The authentication is done by verifying that the public key in the certificate is signed by a trusted third-party Certificate Authority.
If a client is unable to verify the certificate, it can abort communication or prompt the user to continue the communication without authentication.
IMPACT:
By exploiting this vulnerability, man-in-the-middle attacks in tandem with DNS cache poisoning can occur.
Exception:
If the server communicates only with a restricted set of clients who have the server certificate or the trusted CA certificate, then the server or CA certificate may not be available publicly, and the scan will be unable to verify the signature.
SOLUTION:
Please install a server certificate signed by a trusted third-party Certificate Authority.
