Ive managed to get rid of this vulnerability on other ASA5506Xs by enabling the http-only VPN cookie option. but on another one i look after this hasn't cleared the vulnerability.
The greenbone scan returns this:
Set-Cookie: webvpn_as=; expires=Thu, 01 Jan 1970 22:00:00 GMT; path=/; secure
Set-Cookie: webvpnc=; expires=Thu, 01 Jan 1970 22:00:00 GMT; path=/; secure
Set-Cookie: webvpn_portal=; expires=Thu, 01 Jan 1970 22:00:00 GMT; path=/; secure
Set-Cookie: webvpnSharePoint=; expires=Thu, 01 Jan 1970 22:00:00 GMT; path=/; secure
Set-Cookie: samlPreauthSessionHash=; expires=Thu, 01 Jan 1970 22:00:00 GMT; path=/; secure
Set-Cookie: acSamlv2Error=; expires=Thu, 01 Jan 1970 22:00:00 GMT; path=/; secure
Set-Cookie: webvpnlogin=***replaced***; path=/; secure
are missing the "httpOnly" attribute.
Does anyone know how I sort these out? The firewalls clock is correct so not sure where those expiry dates are coming from.
I did see this exact issue was a bug in the OS last year but this firewall is on version 9.8(4)32
