Netasq

CVSS v2 Overall Score: 1.3      

Analysis

Impacted version

A vulnerability has been found in the implementation of TLS on Netasq firewalls 9.0.6 to 9.0.9. Elliptic curve keys used to negotiate an encryption key are the same on every impacted firewalls. This allows an attacker to retrieve the negotiated key and decrypt data. The attacker must be able to capture the encrypted traffic.

This vulnerability impacts the SSL proxy, VPN SSL, authentication portal and administration portal. Successful exploitation of this vulnerability may allow an attacker to read encrypted data as clear-text.

• Netasq 9.0.6 to 9.0.9

Workaround solution

Solution

It is possible to deactivate TLS elliptic curve usage with the CLI console.

You can check if ECDHE is activated on your firewall with this command:

config auth show

You will see some cipher suites with the ECDHE prefix.

You can deactivate ECDHE with the command:

config auth https cipherlist=AES128-SHA
config auth activate
config auth show

SslCipher section should now only contain SslCipher

[SslCipher]
AES128-SHA

You can add additional cipher with the command:

config auth https cipherlist=X,Y

This vulnerability will not be fixed in the affected products. We strongly recommend you to update your firewall with the latest 9.1 version.