cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1150
Views
0
Helpful
2
Replies

CSCux29978 on systems not configured for IKE

awysocki
Level 1
Level 1

For firewalls which do not have Ikev1 or v2 enabled/configured, could the remote code still be executed and either force the reboot or allow for remotely executing code?

1 Accepted Solution

Accepted Solutions

rvarelac
Level 7
Level 7

Hi awysocki

The documentation states you need either a Site-to-Site tunnel running Ikev1 or ikev2 , or a remote connection with ipsec technologies. If you don't have any of those technologies the exploit can't be executed. 

You can check if the IPSec is enabled with the command:

 ciscoasa# show running-config crypto map | include interface
    crypto map outside_map interface outside

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160210-asa-ike

Hope it helps

-Randy-

View solution in original post

2 Replies 2

rvarelac
Level 7
Level 7

Hi awysocki

The documentation states you need either a Site-to-Site tunnel running Ikev1 or ikev2 , or a remote connection with ipsec technologies. If you don't have any of those technologies the exploit can't be executed. 

You can check if the IPSec is enabled with the command:

 ciscoasa# show running-config crypto map | include interface
    crypto map outside_map interface outside

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160210-asa-ike

Hope it helps

-Randy-

Thanks. I apparently skipped that section when reading through.