topic Re: Palo High vulnerability issue. in General Topics

Palo High vulnerability issue.

gejac — Fri, 08 Jun 2012 11:23:35 GMT

Dear,

the palo's on our public internet are being scanned for vulnerabilities and other open issues. Last week scanning a issue regarding "OpenSSL ASN.1 Parsing Vulnerabilities port 443/tcp over SSL" on the portal website of the Palo for ssl-vpn access was detected and marked high.

The security officer now wants to get this solved in a few days. What can we do about it as shutting down SSL portal is not possible either.

Here the full data from this report.

QID: 38224

Category: General remote services

CVE ID: CVE-2003-0543, CVE-2003-0544, CVE-2003-0545, CVE-2005-1730

Vendor Reference: -

Bugtraq ID: 8732

Service Modified: 11/06/2009

User Modified: -

Edited: No

PCI Vuln: Yes

First Detected: 06/05/2012 at 18:01:45 (GMT+0200) Last Detected: 06/05/2012 at 18:01:45 (GMT+0200) Times Detected: 1

SOLUTION:

The OpenSSL Project released OpenSSL versions 0.9.6k and 0.9.7c to address these issues. Any application dynamically linked to OpenSSL

libraries should be restarted after applying fixes. Applications that are statically linked to OpenSSL libraries should be recompiled after upgrading

OpenSSL.

Red Hat released an advisory (RHSA-2003:291-01) to address these issues. Fixes may be applied with the Red Hat Update Agent. Manual fixes are

also listed in the advisory.

OpenPKG released advisory OpenPKG-SA-2003.044 to address these issues. Please see the advisory for details on obtaining and applying fixes.

Apple addressed these issues in MacOS X 10.2.8."

Anyone had the same issue ?

Regards

Geert

Re: Palo High vulnerability issue.

jcostello — Fri, 08 Jun 2012 15:59:57 GMT

+1 to this.

I have an open ticket in regard to this as well.

If you have not opened a ticket with support, please do so it should help with the escalation for resolution

Thanks

James

Re: Palo High vulnerability issue.

jcostello — Fri, 08 Jun 2012 16:06:13 GMT

Couple of clarification questions

What version of PANOS are you running and which VPN/GP client do you have installed - we are running 4.0.11 with NetConnect 1.3.3

Who is you scan provider? We are using Qualys (I believe)

Thanks

James

Re: Palo High vulnerability issue.

tettema — Fri, 08 Jun 2012 17:00:18 GMT

Hi Geert,

As of PAN-OS 4.0.0, we use OpenSLL 0.9.8p, which is not affected by this vulnerability. The Qualys scan cannot confirm the vulnerability exists, so it states it just to be thorough.

Re: Palo High vulnerability issue.

gejac — Sun, 10 Jun 2012 15:22:31 GMT

Hi,

yes we are running 4.0.9 and 4.0.10 ont two different cluster with both 1.3.3, and yes it is Qualys doing the scans.

So suppose we are safe, as since 4.0.0 the updated openssl is being used.

Re: Palo High vulnerability issue.

vkelley — Fri, 07 Sep 2012 05:05:07 GMT

FYI on 4.1.X the OpenSSL version is also OpenSLL 0.9.8

Re: Palo High vulnerability issue.

KiCheon.Lee — Tue, 10 Jun 2014 07:49:02 GMT

Hello,

What version is open SSL Library in PANOS 5.0.x???

Re: Palo High vulnerability issue.

Retired Member — Tue, 10 Jun 2014 07:56:36 GMT

Hi.

PANOS have been used for OPEN SSL 0.9.8 and that has not vulnerability of Open SSL issue. But newer OpenSSL issue has got a problem of PAN and you should call and question your local SE and He can provide you proper information for the issue.

I have been always monitoring for you on the PAN community.

Thanks.

Re: Palo High vulnerability issue.

KiCheon.Lee — Tue, 10 Jun 2014 09:33:25 GMT

Thanks Roh.

Your monitoring always gives me a scare.

Anyway, I need a detail version. For example, 0.9.8p or 0.9.8za or etc.