TCP Source Port Pass Firewall Vulnerability

SubaMuthuram — Mon, 04 Apr 2022 08:10:08 GMT

Hi Team,

We are getting below vulnerability in PA NGFW.

Please find the error below,

IP Status

QID

Title

Type

Severity

Port

Protocol

FQDN

SSL

CVE ID

Vendor Reference

Bugtraq ID

CVSS Base

CVSS Temporal

CVSS3 Base

CVSS3 Temporal

Threat

Impact

Solution

Exploitability

Associated Malware

Results

PCI Vuln

Instance

Category

Result Errors

host scanned, found vuln

34000

TCP Source Port Pass Firewall

Vuln

5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)

3.6 (E:U/RL:W/RC:UC)

Your firewall policy seems to let TCP packets with a specific source port pass through.

Some types of requests can pass through the firewall. The port number listed in the results section of this vulnerability report is the source port that unauthorized users can use to bypass your firewall.

Make sure that all your filtering rules are correct and strict enough. If the firewall intends to deny TCP connections to a specific port, it should be configured to block all TCP SYN packets going to this port, regardless of the source port.

The host responded 4 times to 4 TCP SYN probes sent to destination port 25 using source port 25. However, it did not respond at all to 4 TCP SYN probes sent to the same destination port using a random source port.

yes

Firewall

Re: TCP Source Port Pass Firewall Vulnerability

S.Cantwell — Tue, 05 Apr 2022 20:05:15 GMT

Make sure that all your filtering rules are correct and strict enough. If the
firewall intends to deny TCP connections to a specific port, it should be
configured to block all TCP SYN packets going to this port, regardless of the
source port.

Have you configured the FW to utilize PANW best practices for Zone and Dos Protections?

https://docs.paloaltonetworks.com/best-practices/10-0/dos-and-zone-protection-best-practices

topic Re: TCP Source Port Pass Firewall Vulnerability in General Topics

TCP Source Port Pass Firewall Vulnerability

Re: TCP Source Port Pass Firewall Vulnerability