Cisco Adaptive Security Appliance SSL Bypass Vulnerability

A vulnerability exists in the Secure Sockets Layer (SSL) virtual private network (VPN) Client Certificate Authentication feature for Cisco's Adaptive Security Appliance (ASA).

Threat ID:: CC-2343
Category:: Exploit
Threat Severity:: Medium
Threat Vector:
Published:: 3 May 2018 12:00 AM

Report a cyber attack: call 0300 303 5222 or email [email protected]

This content has been archived

This article no longer conforms to NHS Digital's standards for cyber alerts, and may contain outdated or inaccurate information. Use of this information contained in this page is at your own risk

Summary

A vulnerability exists in the Secure Sockets Layer (SSL) virtual private network (VPN) Client Certificate Authentication feature for Cisco's Adaptive Security Appliance (ASA).

Affected platforms

The following platforms are known to be affected:

Cisco Adaptive Security Appliance (ASA) Software

This vulnerability affects Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defence Software that is running on the following Cisco products:

3000 Series Industrial Security Appliances (ISA)
5500 Series Adaptive Security Appliances
5500-X Series Next-Generation Firewalls
ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers
Adaptive Security Virtual Appliances (ASAv)
Firepower 4110 Security Appliances
Firepower 9300 ASA Security Modules

Cisco Firepower

Cisco Firepower 9300 ASA Security Module

Threat details

This could allow an unauthenticated, remote user to bypass certain SSL certificate verification steps.

Incorrect verification of SSL client certificates can be exploited by an attacker connecting to the ASA VPN without proper private key certificate pairs. This would allow them to establish a successful VPN connection, at which point they would have full network access

Remediation steps

Type	Step
	Cisco have released an update that addresses this vulnerability. Users are encouraged to visit the Cisco Security Advisory and apply this update

Last edited: 17 February 2020 12:39 pm