Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Low-Entropy Keys Vulnerability
A vulnerability in the Deterministic Random Bit Generator (DRBG), also known as Pseudorandom Number Generator (PRNG), used in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a cryptographic collision, enabling the attacker to discover the private key of an affected device. The vulnerability is due to insufficient entropy in the DRBG when generating cryptographic keys. An attacker could exploit this vulnerability by generating a large number of cryptographic keys on an affected device and looking for collisions with target devices. A successful exploit could allow the attacker to impersonate an affected target device or to decrypt traffic secured by an affected key that is sent to or from an affected target device. Cisco has released software updates that address this vulnerability. There are workarounds that address this vulnerability.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2019-1715US | high7.5 | — | ||
A vulnerability in the Deterministic Random Bit Generator (DRBG), also known as Pseudorandom Number Generator (PRNG), used in Cisco Adaptive Security Appliance (ASA) Software and C… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- cisco-sa-20190501-frpwr-dos:external
- cisco-sa-20190501-asa-csrfexternal
- cisco-sa-20190501-asa-frpwrtd-dosexternal
- cisco-sa-20190501-asa-ftd-dosexternal
- Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Low-Entropy Keys Vulnerabilityself
- cisco-sa-20190501-asa-ftd-ike-dosexternal
- cisco-sa-20190501-asa-ipsec-dosexternal
- cisco-sa-20190501-asaftd-saml-vpnexternal
Behebungen (72)
- Behoben6.2.1
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Behoben6.2.2
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Behoben6.2.2.1
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Behoben6.2.2.2
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Behoben6.2.2.3
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Behoben6.2.2.4
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Behoben6.2.3
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Behoben6.2.3.1
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Behoben6.2.3.2
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Behoben9.8.1
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Behoben9.8.1.5
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Behoben9.8.1.7
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Behoben9.8.2
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Behoben9.8.2.10
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Behoben9.8.2.11
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Behoben9.8.2.14
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Behoben9.8.2.15
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Behoben9.8.2.17
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Behoben9.8.2.18
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Behoben9.8.2.19
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Behoben9.8.2.20
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Behoben9.8.2.24
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Behoben9.8.2.26
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Behoben9.8.2.28
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Behoben9.8.2.3
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Behoben9.8.2.33
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Behoben9.8.2.35
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Behoben9.8.2.38
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Behoben9.8.2.8
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Behoben9.9.1
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Behoben9.9.1.2
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Behoben9.9.1.3
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Behoben9.9.1.4
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Behoben9.9.2
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Behoben9.9.2.1
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Behoben9.9.2.9
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Workaround6.2.1
To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or FTD device and then import the base 64 encoded PKCS #12 file containing the keys and certificate(s) to the Cisco ASA or FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. See the ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"] tech note for further details, including steps for how to accomplish this task via the Cisco Adaptive Security Device Manager (ASDM).
- Workaround6.2.2
To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or FTD device and then import the base 64 encoded PKCS #12 file containing the keys and certificate(s) to the Cisco ASA or FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. See the ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"] tech note for further details, including steps for how to accomplish this task via the Cisco Adaptive Security Device Manager (ASDM).
- Workaround6.2.2.1
To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or FTD device and then import the base 64 encoded PKCS #12 file containing the keys and certificate(s) to the Cisco ASA or FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. See the ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"] tech note for further details, including steps for how to accomplish this task via the Cisco Adaptive Security Device Manager (ASDM).
- Workaround6.2.2.2
To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or FTD device and then import the base 64 encoded PKCS #12 file containing the keys and certificate(s) to the Cisco ASA or FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. See the ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"] tech note for further details, including steps for how to accomplish this task via the Cisco Adaptive Security Device Manager (ASDM).
- Workaround6.2.2.3
To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or FTD device and then import the base 64 encoded PKCS #12 file containing the keys and certificate(s) to the Cisco ASA or FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. See the ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"] tech note for further details, including steps for how to accomplish this task via the Cisco Adaptive Security Device Manager (ASDM).
- Workaround6.2.2.4
To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or FTD device and then import the base 64 encoded PKCS #12 file containing the keys and certificate(s) to the Cisco ASA or FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. See the ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"] tech note for further details, including steps for how to accomplish this task via the Cisco Adaptive Security Device Manager (ASDM).
- Workaround6.2.3
To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or FTD device and then import the base 64 encoded PKCS #12 file containing the keys and certificate(s) to the Cisco ASA or FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. See the ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"] tech note for further details, including steps for how to accomplish this task via the Cisco Adaptive Security Device Manager (ASDM).
- Workaround6.2.3.1
To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or FTD device and then import the base 64 encoded PKCS #12 file containing the keys and certificate(s) to the Cisco ASA or FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. See the ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"] tech note for further details, including steps for how to accomplish this task via the Cisco Adaptive Security Device Manager (ASDM).
- Workaround6.2.3.2
To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or FTD device and then import the base 64 encoded PKCS #12 file containing the keys and certificate(s) to the Cisco ASA or FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. See the ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"] tech note for further details, including steps for how to accomplish this task via the Cisco Adaptive Security Device Manager (ASDM).
- Workaround9.8.1
To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or FTD device and then import the base 64 encoded PKCS #12 file containing the keys and certificate(s) to the Cisco ASA or FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. See the ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"] tech note for further details, including steps for how to accomplish this task via the Cisco Adaptive Security Device Manager (ASDM).
- Workaround9.8.1.5
To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or FTD device and then import the base 64 encoded PKCS #12 file containing the keys and certificate(s) to the Cisco ASA or FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. See the ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"] tech note for further details, including steps for how to accomplish this task via the Cisco Adaptive Security Device Manager (ASDM).
- Workaround9.8.1.7
To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or FTD device and then import the base 64 encoded PKCS #12 file containing the keys and certificate(s) to the Cisco ASA or FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. See the ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"] tech note for further details, including steps for how to accomplish this task via the Cisco Adaptive Security Device Manager (ASDM).
- Workaround9.8.2
To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or FTD device and then import the base 64 encoded PKCS #12 file containing the keys and certificate(s) to the Cisco ASA or FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. See the ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"] tech note for further details, including steps for how to accomplish this task via the Cisco Adaptive Security Device Manager (ASDM).
- Workaround9.8.2.10
To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or FTD device and then import the base 64 encoded PKCS #12 file containing the keys and certificate(s) to the Cisco ASA or FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. See the ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"] tech note for further details, including steps for how to accomplish this task via the Cisco Adaptive Security Device Manager (ASDM).
- Workaround9.8.2.11
To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or FTD device and then import the base 64 encoded PKCS #12 file containing the keys and certificate(s) to the Cisco ASA or FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. See the ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"] tech note for further details, including steps for how to accomplish this task via the Cisco Adaptive Security Device Manager (ASDM).
- Workaround9.8.2.14
To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or FTD device and then import the base 64 encoded PKCS #12 file containing the keys and certificate(s) to the Cisco ASA or FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. See the ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"] tech note for further details, including steps for how to accomplish this task via the Cisco Adaptive Security Device Manager (ASDM).
- Workaround9.8.2.15
To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or FTD device and then import the base 64 encoded PKCS #12 file containing the keys and certificate(s) to the Cisco ASA or FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. See the ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"] tech note for further details, including steps for how to accomplish this task via the Cisco Adaptive Security Device Manager (ASDM).
- Workaround9.8.2.17
To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or FTD device and then import the base 64 encoded PKCS #12 file containing the keys and certificate(s) to the Cisco ASA or FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. See the ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"] tech note for further details, including steps for how to accomplish this task via the Cisco Adaptive Security Device Manager (ASDM).
- Workaround9.8.2.18
To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or FTD device and then import the base 64 encoded PKCS #12 file containing the keys and certificate(s) to the Cisco ASA or FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. See the ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"] tech note for further details, including steps for how to accomplish this task via the Cisco Adaptive Security Device Manager (ASDM).
- Workaround9.8.2.19
To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or FTD device and then import the base 64 encoded PKCS #12 file containing the keys and certificate(s) to the Cisco ASA or FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. See the ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"] tech note for further details, including steps for how to accomplish this task via the Cisco Adaptive Security Device Manager (ASDM).
- Workaround9.8.2.20
To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or FTD device and then import the base 64 encoded PKCS #12 file containing the keys and certificate(s) to the Cisco ASA or FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. See the ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"] tech note for further details, including steps for how to accomplish this task via the Cisco Adaptive Security Device Manager (ASDM).
- Workaround9.8.2.24
To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or FTD device and then import the base 64 encoded PKCS #12 file containing the keys and certificate(s) to the Cisco ASA or FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. See the ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"] tech note for further details, including steps for how to accomplish this task via the Cisco Adaptive Security Device Manager (ASDM).
- Workaround9.8.2.26
To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or FTD device and then import the base 64 encoded PKCS #12 file containing the keys and certificate(s) to the Cisco ASA or FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. See the ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"] tech note for further details, including steps for how to accomplish this task via the Cisco Adaptive Security Device Manager (ASDM).
- Workaround9.8.2.28
To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or FTD device and then import the base 64 encoded PKCS #12 file containing the keys and certificate(s) to the Cisco ASA or FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. See the ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"] tech note for further details, including steps for how to accomplish this task via the Cisco Adaptive Security Device Manager (ASDM).
- Workaround9.8.2.3
To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or FTD device and then import the base 64 encoded PKCS #12 file containing the keys and certificate(s) to the Cisco ASA or FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. See the ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"] tech note for further details, including steps for how to accomplish this task via the Cisco Adaptive Security Device Manager (ASDM).
- Workaround9.8.2.33
To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or FTD device and then import the base 64 encoded PKCS #12 file containing the keys and certificate(s) to the Cisco ASA or FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. See the ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"] tech note for further details, including steps for how to accomplish this task via the Cisco Adaptive Security Device Manager (ASDM).
- Workaround9.8.2.35
To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or FTD device and then import the base 64 encoded PKCS #12 file containing the keys and certificate(s) to the Cisco ASA or FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. See the ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"] tech note for further details, including steps for how to accomplish this task via the Cisco Adaptive Security Device Manager (ASDM).
- Workaround9.8.2.38
To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or FTD device and then import the base 64 encoded PKCS #12 file containing the keys and certificate(s) to the Cisco ASA or FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. See the ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"] tech note for further details, including steps for how to accomplish this task via the Cisco Adaptive Security Device Manager (ASDM).
- Workaround9.8.2.8
To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or FTD device and then import the base 64 encoded PKCS #12 file containing the keys and certificate(s) to the Cisco ASA or FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. See the ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"] tech note for further details, including steps for how to accomplish this task via the Cisco Adaptive Security Device Manager (ASDM).
- Workaround9.9.1
To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or FTD device and then import the base 64 encoded PKCS #12 file containing the keys and certificate(s) to the Cisco ASA or FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. See the ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"] tech note for further details, including steps for how to accomplish this task via the Cisco Adaptive Security Device Manager (ASDM).
- Workaround9.9.1.2
To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or FTD device and then import the base 64 encoded PKCS #12 file containing the keys and certificate(s) to the Cisco ASA or FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. See the ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"] tech note for further details, including steps for how to accomplish this task via the Cisco Adaptive Security Device Manager (ASDM).
- Workaround9.9.1.3
To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or FTD device and then import the base 64 encoded PKCS #12 file containing the keys and certificate(s) to the Cisco ASA or FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. See the ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"] tech note for further details, including steps for how to accomplish this task via the Cisco Adaptive Security Device Manager (ASDM).
- Workaround9.9.1.4
To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or FTD device and then import the base 64 encoded PKCS #12 file containing the keys and certificate(s) to the Cisco ASA or FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. See the ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"] tech note for further details, including steps for how to accomplish this task via the Cisco Adaptive Security Device Manager (ASDM).
- Workaround9.9.2
To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or FTD device and then import the base 64 encoded PKCS #12 file containing the keys and certificate(s) to the Cisco ASA or FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. See the ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"] tech note for further details, including steps for how to accomplish this task via the Cisco Adaptive Security Device Manager (ASDM).
- Workaround9.9.2.1
To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or FTD device and then import the base 64 encoded PKCS #12 file containing the keys and certificate(s) to the Cisco ASA or FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. See the ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"] tech note for further details, including steps for how to accomplish this task via the Cisco Adaptive Security Device Manager (ASDM).
- Workaround9.9.2.9
To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or FTD device and then import the base 64 encoded PKCS #12 file containing the keys and certificate(s) to the Cisco ASA or FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. See the ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"] tech note for further details, including steps for how to accomplish this task via the Cisco Adaptive Security Device Manager (ASDM).
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan