the advisory wasn't quite clear to me as it got 2 parts: webvpn feature enabled and the SSL and DTLS listen socket.
i got ASA that has no webvpn (it's just a NAT FW), but when i checked the show asp table socket output, it has SSL (no DTLS) listening on the "inside" and MGMT interface IP. my question is, do i still need to do an IOS upgrade even though webvpn is disabled?
# show run webvpn # <<< BLANK # show asp table socket | i SSL
SSL 00002e7f 172.x.x.130:443 0.0.0.0:* LISTEN <<< MGMT IP SSL 00005aef 172.x.x.13:443 0.0.0.0:* LISTEN <<< "inside" IP
# # show asp table socket | i DTLS # <<< BLANK
i also saw ASA FW (on 8.2) that has webvpn but it's not being applied to any interface. can i just safely remove (put a no) and not be vulnerable? not sure if webvpn was a default on older 8.2 image.
ntp server x.x.x.x webvpn username xx password yyy encrypted privilege 15
Unless webvpn is configured AND enabled on an interface, the ASA is not affected by the vulnerability, you are right there. Since ASDM and Webvpn uses both ssl, you see ssl listen on inside interface. But you would need SSL and DTLS for this vulnerability to be affecting on your device and that is when webvpn is enabled on any interface.
As a side note, since you mentioned about the 8.2 code, I would recommend an upgrade since that is quite old and EOS already. It has anyways multiple bugs and Cisco would not even support it if there are issues.
I would have a question. If two-factor authetication is in place with user cerificates. Does it mean that set of potentional attackers are the users with certificates only? Because only these users are able successfully enstablish SSL connection.
No matter how the users authenticate, its the vulnerability on the server(in this case, ASA) and affects if the conditions meet as per the link. Also, from the document:
A vulnerability in the Secure Sockets Layer (SSL) VPN functionality of the Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to cause a reload of the affected system or to remotely execute code.
We’re excited to announce new capabilities with Secure Endpoint that allow you to simplify your security and maximize your security operations: Unify your security stack and reduce agent fatigue with Cisco Secure Client; harness integrated risk-based vuln...
Listen: https://smarturl.it/CCRS8E47 Follow us: twitter.com/ciscochampions
Ransomware, fileless malware, and zero-day attacks continue to target organizations around the world. In response, organizations have resorted to deploying a variety of d...
This is a general information page for Cisco Threat Centric (TC-NAC) with ISE
Threat Centric Network Access Control (TC-NAC) feature enables you to create authorization policies based on the threat and vulnerability attributes received from the th...
The 2021 IT Blog Awards, hosted by Cisco, is now open for submissions. Submit your blog, vlog or podcast today. For more information, including category details, the process, past winners and FAQs, check out: https://www.cisco.com/c/en/us/t...
Cisco Secure Endpoint (formerly AMP for Endpoints) will decommission legacy cloud servers, which results in Legacy Windows Connector Versions 3.x/4.x and Mac Connector Version 1.0.x ceasing to ...