topic Re: PCI DSS testing failure in General Topics

PCI DSS testing failure

ReminderMedia — Mon, 03 Mar 2014 20:03:16 GMT

We are using SecurityMetrics to test for PCI compliance and have recently started receiving a failure based on TCP/IP Initial Sequence Number (ISN) Reuse Weakness (CVE-2002-1463) for the PaloAlto firewall (5.0.8).

I'm not sure how to remedy the problem within the firewall. There have been no rule changes that should have caused this to start to occur but we have updated the firewall from previous release.

Re: PCI DSS testing failure

HULK — Mon, 03 Mar 2014 21:18:55 GMT

Hello Sir,

If the firewall is failing the test, we would need to get some more information about how you are testing the device and what the firewall is doing that causes it to fail. Both of the vulnerabilities are somewhat old and not modern firewall should be affected by them. We could create a zone protection profile, that gives you control over the how the firewall responds to specific packet based attacks.

The PAN-OS Administrator's Guide has some basic information about zone protection,

https://live.paloaltonetworks.com/docs/DOC-6603

Here are two documents that explain how the Paloalto handles TCP connections,

https://live.paloaltonetworks.com/docs/DOC-1731

https://live.paloaltonetworks.com/docs/DOC-1628

Although, the above mentioned problem looking like a BUG-44798- Weak sequence number generation vulnerability on MP (management-plane) CVE-2011-3188 and CVE-2002-1463. This problem has been fixed in PAN OS 6.0.0.

Thanks

Re: PCI DSS testing failure

bmccall136 — Thu, 16 Apr 2015 17:38:48 GMT

I'm getting the same thing and I'm on PAN OS 6.1.2. Any more updates on this?

Re: PCI DSS testing failure

jmwilkinson — Wed, 20 Mar 2019 14:33:47 GMT

Got a similar PCI DSS testing failure from pcicompliancemanager: CVE-2002-1463 BID : 5387, 8652 TCP/IP Initial Sequence Number (ISN) Reuse Weakness... Currently on PANOS 8.0.12 and find this highly suspect.. Any new details on this?

Re: PCI DSS testing failure

ITRHPL — Mon, 06 Dec 2021 16:29:11 GMT

We are experiencing the same issue from our PCI vendor. It was never an issue in the past. The only thing we've change is updated to the newest software 9.1.11. How did you all correct the problem?

Re: PCI DSS testing failure

jmwilkinson — Wed, 08 Dec 2021 19:00:48 GMT

It actually happened twice and I ended up reporting the findings as false positives on both occasions. I provided some documentation/information etc. The finding was corrected after an upgrade past the 9.1.13.