topic Re: How to "fix" vulnerabilities. in General Topics

How to "fix" vulnerabilities.

johnd — Mon, 17 Sep 2012 08:43:22 GMT

Hi,

I have a lot of vulnerabilities that keeps triggering in my firewall, but I'm not sure whats causing it or how to fix it.

Most "attacks" are done by servers or clients on my own network...

- Microsoft Windows SMB Fragmentation RPC Request Attempt (14K). Any ideas how to fix this.

- HTTP Forbidden Error (7K). This would make sende if it was 30-40 alerts, but not 7K in the last 30 days.

- HTTP WWW-Authentication Failed (4K). Could this be caused by the exchange client?

- DNS Answer Big TXT Record Response Anomaly (1K)

Thank you

Re: How to "fix" vulnerabilities.

bstapleton — Tue, 18 Sep 2012 14:29:04 GMT

Hey johnd,

We're in the same boat. We get many vulnerability hits internally of the same type as yours.

The thing to do seems to be to open a case with PAN support for each vuln. It's best to start with the ones that are blocking traffic rather than just alerting you. Then, IMHO, go for the ones that are most annoying and are most easily reproduced. PAN support will most likely ask you to reproduce the alert with packet capturing on and to add the files or other data to the case that's being transmitted when the vulnerability is identified.

The end result may be surprising. We generated a case because traffic between our Microsoft SCCM servers and their clients generated many thousands of 40026: SSL Renegotiation Denial of Service vulnerabilities. We did the packet captures and submitted file samples. PAN support came back and said that, yes indeed, this is vulnerable traffic. There seemed to be no more recourse with PAN support; we could then go to Microsoft to see why they're transmitting vulnerable traffic as part of their protocols. In the end, we decided to keep the Microsoft SCCM servers running as they were and supress the alerts on the Palo Altos.

Re: How to "fix" vulnerabilities.

essnet — Tue, 18 Sep 2012 14:49:47 GMT

In most contexts, I would say these 4 alerts should be ignored, so disabled.