Cisco ASA SSL VPN Vulnerability

[johnlloyd_13]

hi,

cisco recently released a security advisory/CVE regarding SSL VPN vulnerability.

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180129-asa1

the advisory wasn't quite clear to me as it got 2 parts: webvpn feature enabled and the SSL and DTLS listen socket.

i got ASA that has no webvpn (it's just a NAT FW), but when i checked the show asp table socket output, it has SSL (no DTLS) listening on the "inside" and MGMT interface IP. my question is, do i still need to do an IOS upgrade even though webvpn is disabled?

# show run webvpn
#    <<< BLANK
# show asp table socket | i SSL

SSL       00002e7f  172.x.x.130:443            0.0.0.0:*               LISTEN   <<< MGMT IP 
SSL       00005aef  172.x.x.13:443             0.0.0.0:*               LISTEN    <<< "inside" IP 
                           
#
# show asp table socket | i DTLS
#   <<< BLANK

i also saw ASA FW (on 8.2) that has webvpn but it's not being applied to any interface. can i just safely remove (put a no) and not be vulnerable? not sure if webvpn was a default on older 8.2 image.

ntp server x.x.x.x
webvpn
username xx password yyy encrypted privilege 15

[Ajay Saini]

Unless webvpn is configured AND enabled on an interface, the ASA is not affected by the vulnerability, you are right there. Since ASDM and Webvpn uses both ssl, you see ssl listen on inside interface. But you would need SSL and DTLS for this vulnerability to be affecting on your device and that is when webvpn is enabled on any interface.

As a side  note, since you mentioned about the 8.2 code, I would recommend an upgrade since that is quite old and EOS already. It has anyways multiple bugs and Cisco would not even support it if there are issues.

-

HTH
AJ

[Tomas R.]

Hello,

I would have a question. If two-factor authetication is in place with user cerificates. Does it mean that set of potentional attackers are the users with certificates only? Because only these users are able successfully enstablish SSL connection.

Thank you

Tomas

[Ajay Saini]

Hello,

No matter how the users authenticate, its the vulnerability on the server(in this case, ASA) and affects if the conditions meet as per the link. Also, from the document:

A vulnerability in the Secure Sockets Layer (SSL) VPN functionality of the Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to cause a reload of the affected system or to remotely execute code.

HTH

AJ

[Tomas R.]

Hello,

thank you for response.

Regards

Tomas