CVE-2017-12373 Cisco ASA Bleichenbacher attack on TLS Information Disclosure Vulnerability(ROBOT)

A vulnerability in the TLS protocol implementation of legacy Cisco ASA devices could allow an unauthenticated, remote attacker to access sensitive information. The vulnerability is due to improper implementation of countermeasures against the Bleichenbacher attack for cipher suites that rely on RSA for key exchange.
This vulnerability affects the listed ASA models when they are using an SSL trustpoint associated with a 2048-bit RSA key.

An attacker could exploit this vulnerability by sending crafted TLS messages to the device, which would act as an oracle and allow the attacker to carry out a chosen-ciphertext attack.

More information can be obtained from cisco-sa-20171212-bleichenbacher Workaround:

- Enable "crypto engine large-mod-accel" in the ASA configuration. This configuration change might reduce the maximum SSL throughput by up to 50%. This workaround is not available for the ASA 5505.
or:
- Configure "ssl encryption" to only allow cipher suites based on Diffie-Hellman key exchange (like "dhe-aes128-sha1" and "dhe-aes256-sha1"). This mitigation may have an impact on interoperability with legacy clients that might not support these ciphers.

Patch:
Following are links for downloading patches to fix the vulnerabilities:

CSCvg97652: Cisco ASA