How to disable the use of SSL compression on HTTP-TLS interfaces on the device.

aniz.mohammed@futuretec.com.kw — Tue, 03 Dec 2013 13:47:11 GMT

Dear All,

Please help me on this issue. The IT Security Audit team has scanned the PaloAlto Firewall PA-2050 and they found this vulnerability:

*********************************************************************************************************

62565 (1) - TLS CRIME Vulnerability

Synopsis:

The remote service has a configuration that may make it vulnerable to the CRIME attack.

Description:

The remote service has one of two configurations that are known to be required for the CRIME attack:

- SSL / TLS compression is enabled.

- TLS advertises the SPDY protocol earlier than version 4.

Solution:

Disable compression and / or the SPDY service.

Risk Factor:

Medium

*********************************************************************************************************

According to the document from PaloAlto "PAN-OS 5.0.3: Release Notes > Addressed Issues" there is:

47813 -- Made a change to disable the use of SSL compression on HTTP-TLS interfaces on the device.

So, How can we disable this SSL compression?

Regards,

Aniz

Re: How to disable the use of SSL compression on HTTP-TLS interfaces on the device.

kadak — Wed, 04 Dec 2013 01:09:25 GMT

Hello Aniz,

SPDY feature can be disabled in Chrome's browser properties.

Please refer the following document:

Let me know if that helps you!

Thanks and regards,
Kunal Adak