There are no workarounds that address this vulnerability. However, this vulnerability exists only when FTP is enabled on the management interface. If FTP is disabled, this vulnerability does not exist; therefore, disabling FTP is considered a mitigation for the vulnerability.
Disabling FTP on the Management Interface
An administrator can disable FTP on the management interface by using one of the following two methods.
First Method to Disable FTP on the Management Interface
The administrator can disable FTP by issuing the ifconfig command to edit the management interface configuration and then issuing the commit command to commit the change.
ciscowsa> ifconfig
.
.
.
Choose the operation you want to perform:
- NEW - Create a new interface.
- EDIT - Modify an interface.
- DELETE - Remove an interface.
- DETAILS - Show details of an interface.
> EDIT
Enter the number of the interface you wish to edit.
[]> 1
.
.
Do you want to enable FTP on this interface? [Y]> N
.
.
.
Choose the operation you want to perform:
- NEW - Create a new interface.
- EDIT - Modify an interface.
- DELETE - Remove an interface.
- DETAILS - Show details of an interface.
[]>
ciscowsa> commit
Warning: In order to process these changes, the proxy process will restart after Commit. This will cause a brief interruption in service. Additionally, the authentication cache will be cleared, which might require some users to authenticate again.
Warning: Processing of network configuration changes might cause a brief interruption in network availability.
Please enter some comments describing your changes:
[]> disable FTP
Changes committed
.
.
.
Second Method to Disable FTP on the Management Interface
The administrator can disable FTP from the GUI by navigating to Network > Interfaces > Appliance Management Services and unchecking the FTP check box, then clicking Submit to commit the change.