ASA - web vulnurbilities

amardram123 · ‎05-25-2010

Dear All,

Our audit team has identified som vulnerbilities, which i am not able to understand.. need help if their queries are correct and these unwanted services can be blocked on ASA.

Queries:

The presence of the URI 'cart32.exe' has been discovered on the web server. This resource could potentially allow malicious individuals to compromise a web servers security through multiple exploit and attack vectors. This vulnerability could possibly lead to further compromise of the web server's integrity.

The presence of the URI 'ccbill/' has been discovered on the web server. This resource could potentially allow malicious individuals to compromise a web servers security through multiple exploit and attack vectors. This vulnerability could possibly lead to further compromise of the web server's integrity.

The presence of the URI 'ccbill2/' has been discovered on the web server. This resource could potentially allow malicious individuals to compromise a web servers security through multiple exploit and attack vectors. This vulnerability could possibly lead to further compromise of the web server's integrity.

The presence of the URI 'creditcards/' has been discovered on the web server. This resource could potentially allow malicious individuals to compromise a web servers security through multiple exploit and attack vectors. This vulnerability could possibly lead to further compromise of the web server's integrity.

Plez help if these services can be blocked..

Regards

Amar

Magnus Mortensen · ‎05-25-2010

Amar,

I assume that you have some kind of Webserver behind the ASA and you are scanning that Webserver's IP for vulnerabilities, correct? The ASA itself does not have anything remotely close to files like cart32/ccbill etc. Are you unable to simply remove those files/services from your webserver? If you cannot remove them from the webserver, we can use the ASA to block access attempts to anything on that webserver if the URI contains any of the keywords ccbill/cart32. Is that what you are looking to do?

johndrakes · ‎05-30-2010

Also this is found with the issue:

- with webvpn enabled on any port other then the default (443) the webvpn http server responds to the url http://:/
- you can change to any text you wish, as long as it ends in .exe the asa sends the client a 0 byte .exe file

Has anyone came across such issue and how can it lead to security attack.

amardram123 · ‎06-15-2010

yes..

regards

amar