Hi Aydin
We just got their report and 2 log files. They used a bunch of 10 ip addresses to test vulnerabilities and attack the ASAs (main 5525-X, backup 5520). I checked their logs. All these ip addresses were rejected or (ACL) denied by the ASAs. However, there was no version information in the log files. So I have no idea how they could display the ios version, but they said it can be seen over the internet. Our worry is that any attacker (who may guess the internal ip address) may use known vulnerabilities of ios 9.1(2) to attack the ASAs. For this, we need to mask (encrypt?) the ios version to outsiders, and restrict it to only authorized users. They also added that system information, and other important information together with some "unproper page" are unnecessarily publicly displayed (?). They recommended us to properly configure the access control (in order not to publicise these informations to outsiders), upgrade (or downgrade?) the current version to a newer version without vulnerabilities (?), and restrict access to the new ios software service to only authorized users (or service personnel). The original report is in Japanese, so I tried to (literally) convey as much precise information as possible. There was no explanation on how they found these problems. It seems they want some kind of advanced settings to mask (encrypt) critical informations to non-authorized personnel or outsiders. They are probably seeking the impossible but I have no idea. Any help or advice will be highly appreciated. Thanks.
