Supported ASA version that not have an impact for SAML integration

[arumugasamy]

We would like to request for an advice for the below vulnerability on Cisco Anyconnect :

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ac-csc-privesc-wx4U4Kw

Our current version info as below:

Cisco Anyconnect client ver.- 4.10.06079

ASA 5545/85

Cisco ASA ver- 9.14(4)

ASDM version – 7.16(1)150

VPN users Authentication method – SAML integrated.

Kindly review and let us know about the upgrade requirements.  Please help me.

In my knowledge, the ASA 5500 supports max version 9.14. (4) that is not supporting the required VPN client that prevents the said vulnerability.We need to upgrade the ASA to 9.17.X that this particular model would not support.

Minimum ASA/ASDM Release Requirements for Specified Features

• We must upgrade to Secure Firewall ASA 9.17.x (or later) and ASDM 7.17.x (or later)

ASA 9.14(x) was the final version for the ASA 5525-X, 5545-X, and 5555-X

Please give your finding.

[Aref Alsouqi · Accepted solution]

You are right, the latest you can install on those boxes is the 9.14. However, the vulnerability link is referring to AnyConnect, not to the ASA code in itself unless I missed something. In that case, you just need to upgrade the AnyConnect image on those boxes without worrying about upgrading the codes.

[arumugasamy]

Thank you so much
It clearing says the version higher than 9.14 is need to support Latest Anyconnect client but you suggest to use the latest client with the same ASA image 9.14.(4).
Please confirm again. ASA 9.14.(4) is the final version installed

[MHM Cisco World]

https://www.cisco.com/c/en/us/td/docs/security/asa/compatibility/asamatrx.html

According to cisco doc. 9.14 is last ver. For asa 5525/5545/5555