Vulnerability Note VU#563673

The Cisco Adapative Security Appliance (ASA) is a firewall with Intrusion Protection System (IPS), Stateful Packet Inspection (SPI), and routing features. The Cisco ASA includes Authentication, Authorization and Accounting (AAA) support that allows adminsitrators and users to use a single set of credentials to manage multiple devices.

When setting up or troubleshooting the ASA server's AAA authentication features, the test button can be used to confirm that the AAA service is functioning properly.

When the test button is clicked, the AAA username and password will be sent to the syslog service in plain text. If remote syslog is enabled, the credentials will be transmitted across the network in plain text, and stored on the syslog server in plain text.

In the below screenshot, the vulnerable input box has been highlighted.

Authentication credentials may be stored in plain text, possibly on remote servers. The credentials may also be sent unencrypted over the network.

See the "Sytems Affected" section of this document for more information about obtaining updates.

The following workarounds may partially mitigate this vulnerability:

• Check log files for stored AAA credentials, and change passwords if needed.
• Use management VLANs to seperate syslog network traffic from other devices on the network.
• Use access controls, file permissions, and physical security to ensure that syslog files can not be read by unauthorized individuals.