Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

ASA - web vulnurbilities

Dear All,

Our audit team has identified som vulnerbilities, which i am not able to understand.. need help if their queries are correct and these unwanted services can be blocked on ASA.

Queries:

The presence of the URI 'cart32.exe' has been discovered on the web server. This resource could potentially allow malicious individuals to compromise a web servers security through multiple exploit and attack vectors. This vulnerability could possibly lead to further compromise of the web server's integrity.

The presence of the URI 'ccbill/' has been discovered on the web server. This resource could potentially allow malicious individuals to compromise a web servers security through multiple exploit and attack vectors. This vulnerability could possibly lead to further compromise of the web server's integrity.

The presence of the URI 'ccbill2/' has been discovered on the web server. This resource could potentially allow malicious individuals to compromise a web servers security through multiple exploit and attack vectors. This vulnerability could possibly lead to further compromise of the web server's integrity.

The presence of the URI 'creditcards/' has been discovered on the web server. This resource could potentially allow malicious individuals to compromise a web servers security through multiple exploit and attack vectors. This vulnerability could possibly lead to further compromise of the web server's integrity.

Plez help if these services can be blocked..

Regards

Amar

3 REPLIES
Cisco Employee

Re: ASA - web vulnurbilities

Amar,

     I assume that you have some kind of Webserver behind the ASA and you are scanning that Webserver's IP for vulnerabilities, correct? The ASA itself does not have anything remotely close to files like cart32/ccbill etc. Are you unable to simply remove those files/services from your webserver? If you cannot remove them from the webserver, we can use the ASA to block access attempts to anything on that webserver if the URI contains any of the keywords ccbill/cart32. Is that what you are looking to do?

New Member

Re: ASA - web vulnurbilities


Also this is found with the issue:

- with webvpn enabled on any port other then the default (443) the   webvpn http server responds to the url   http://:/
- you can change to any text you wish, as long as  it ends in .exe the asa sends the client a 0 byte .exe file

Has anyone came across such issue and how can it lead to security  attack.

New Member

Re: ASA - web vulnurbilities

yes..

regards

amar

1264
Views
0
Helpful
3
Replies