Detections
Analytics
Cisco ASA TLS CBC Information Disclosure (CSCus08101)
medium Nessus Plugin ID 82429
Language:
Synopsis
The remote device is missing a vendor-supplied security patch.Description
According to its banner, the version of Cisco ASA software on the remote device is affected by an information disclosure vulnerability due to improper block cipher padding by TLSv1 when using Cipher Block Chaining (CBC) mode. A remote attacker, via an 'Oracle Padding' side channel attack, can exploit this vulnerability to gain access to sensitive information. Note that this is a variation of the POODLE attack.Solution
Apply the relevant patch referenced in the vendor advisory.See Also
https://www.imperialviolet.org/2014/12/08/poodleagain.html
https://tools.cisco.com/bugsearch/bug/CSCus08101
https://tools.cisco.com/security/center/viewAlert.x?alertId=36740
Plugin Details
Severity: Medium
ID: 82429
File Name: cisco-sa-CSCus08101-tls-poodle-asa.nasl
Version: 1.6
Type: local
Family: CISCO
Published: 3/30/2015
Updated: 8/9/2018
Supported Sensors: Nessus
Vulnerability Information
CPE: cpe:/a:cisco:adaptive_security_appliance_software
Required KB Items: Host/Cisco/ASA
Patch Publication Date: 3/26/2015
Vulnerability Publication Date: 12/11/2014
Reference Information
CISCO-BUG-ID: CSCus08101