Cisco Adaptive Security Appliance Software Low Entropy Keys (cisco-sa-asa5500x-entropy-6v9bHVYP)
medium Nessus Plugin ID 173732
Synopsis
The remote device is missing a vendor-supplied security patchDescription
A vulnerability in the deterministic random bit generator (DRBG), also known as pseudorandom number generator (PRNG) in Cisco Adaptive Security Appliance (ASA) Software for Cisco ASA 5506-X, ASA-5508-X and ASA 5516-X Firewalls could allow an unauthenticated, remote attacker to cause a cryptographic collision, enabling the attacker to discover the private key of an affected device.Note that devices running a fixed version of Cisco ASA Software may also be affected if they are configured with an ECDSA or RSA key pair that has been generated while running an affected release. If there is doubt, Cisco recommends regenerating all ECDSA and RSA key pairs that are configured on the device.
Please see the included Cisco BIDs and Cisco Security Advisory for more information.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Upgrade to the relevant fixed version referenced in Cisco bug ID CSCvm90511See Also
Plugin Details
Severity : Medium
ID : 173732
File Name : cisco-sa-asa5500x-entropy-6v9bHVYP-asa.nasl
Version : 1.0
Type : local
Family : CISCO
Published : 3/31/2023
Updated : 3/31/2023
Configuration : Enable paranoid mode
Risk Information
VPR
Risk Factor : Medium
Score : 4.4
CVSS v2
Risk Factor : Medium
Base Score : 5
Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSS Score Source : CVE-2023-20107
CVSS v3
Risk Factor : Medium
Base Score : 5.3
Vector : CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Vulnerability Information
CPE : cpe:/a:cisco:adaptive_security_appliance_software
Required KB Items : Host/Cisco/ASA/model , Settings/ParanoidReport
Patch Publication Date : 2/22/2023
Vulnerability Publication Date : 3/22/2023
Reference Information
CVE : CVE-2023-20107