Solved

Cisco ASA 5505 Possible Vulnerability in Net Tools PKI Server 1.0

Posted on 2011-02-25
2
1,281 Views
Last Modified: 2012-05-11
I am trying to get our Cisco ASA 5505 running version 8.2(1) to pass a PCI compliance check.  I have one remaining issue to fix which is caused by the website on the ASA that allows SSL VPN access.

The message I get from the PCI compliance scan is 444:TCP Possible vulnerability in Net Tools PKI Server.  Contact the vendor for Hotfix 3 for Net Tools PKI Server 1.0.  

Port 444 is where I am running the SSL VPN portal

My question is, is this taken care of in version 8.2.2ED?  That is the only version that shows in my download list in the Upgrade Software from Cisco.com wizard within the asdm.
0
Comment
Question by:Steve Bantz
2 Comments
 
LVL 79

Accepted Solution

by:
lrmoore earned 50 total points
ID: 34988796
Did you assign a certificate to the ssl web service? Is it a commercial cert or a self-signed cert?
In Device Management / SSL Settings, choose SSL version for the security appliance to negotiate: SSL V3 Only
It's generally the SSL V1 that is the problem with the scanners..
I would go ahead and upgrade from 8.2.1. The latest available is 8.2.4
0
 

Author Comment

by:Steve Bantz
ID: 35000846
It was running a self signed certificate.  I did change it to only accept SSL V3 only and it passed the PCI scan after that.  Thanks.
0

Featured Post

Networking for the Cloud Era

Join Microsoft and Riverbed for a discussion and demonstration of enhancements to SteelConnect:
-One-click orchestration and cloud connectivity in Azure environments
-Tight integration of SD-WAN and WAN optimization capabilities
-Scalability and resiliency equal to a data center

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Cisco IP Phone upgrade 3 35
Lync - CUCM Integration Question 2 34
Cisco ASA VPN Client Routing 8 40
NAT/PAT unable to config correctly 7 15
If you have an ASA5510 then this sort of thing would be better handled with a CSC Module, however on an ASA5505 thats not an option, and if you want to throw in a quick solution to stop your staff going to facebook during work time, then this is the…
I recently attended Cisco Live! in Las Vegas, a conference that boasted over 28,000 techies in attendance, and a week of hands-on learning hosted by a solid partner with which Concerto goes to market.  Every year, Cisco displays cutting-edge technol…
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…

856 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question