Cisco Firepower Threat Defense Software Low Entropy Keys (cisco-sa-asa5500x-entropy-6v9bHVYP)

high Nessus Plugin ID 173731

Language:

Synopsis

The remote device is missing a vendor-supplied security patch

Description

A vulnerability in the deterministic random bit generator (DRBG), also known as pseudorandom number generator (PRNG) in Cisco Firepower Threat Defense (FTD) Software for Cisco ASA 5506-X, ASA-5508-X and ASA 5516-X Firewalls could allow an unauthenticated, remote attacker to cause a cryptographic collision, enabling the attacker to discover the private key of an affected device.

Note that devices running a fixed version of Cisco FTD Software may also be affected if they are configured with an ECDSA or RSA key pair that has been generated while running an affected release. If there is doubt, Cisco recommends regenerating all ECDSA and RSA key pairs that are configured on the device.

Please see the included Cisco BIDs and Cisco Security Advisory for more information.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to the relevant fixed version referenced in Cisco bug ID CSCvm90511

Plugin Details

Severity: High

ID: 173731

File Name: cisco-sa-asa5500x-entropy-6v9bHVYP-ftd.nasl

Version: 1.3

Type: local

Family: CISCO

Published: 3/31/2023

Updated: 5/31/2024

Configuration: Enable paranoid mode

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.6

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N

CVSS Score Source: CVE-2023-20107

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:cisco:firepower_threat_defense

Required KB Items: Settings/ParanoidReport, installed_sw/Cisco Firepower Threat Defense

Exploit Ease: No known exploits are available

Patch Publication Date: 2/22/2023

Vulnerability Publication Date: 3/22/2023

Reference Information

CVE: CVE-2023-20107

CWE: 20

CISCO-SA: cisco-sa-asa5500x-entropy-6v9bHVYP

IAVA: 2023-A-0165-S

CISCO-BUG-ID: CSCvm90511

Detections

Analytics