topic Re: SSL Weak CBC Mode Vulnerability in General Topics

SSL Weak CBC Mode Vulnerability

u5273 — Mon, 19 Mar 2012 10:28:46 GMT

Our box was scanned by Qualys and the SSL VPN portal cames up with the following message:

If possible, upgrade to TLS v1.1 or TLS v1.2. If upgrading is not possible, then disabling CBC mode cipher will remove the vulnerability.

Any ideas how to disable CBC mode cipher on the PA device. Is there any impact on doing this ?

rgds

Johan

Re: SSL Weak CBC Mode Vulnerability

mikand — Mon, 19 Mar 2012 10:40:22 GMT

As a test, do you get the same result when you enable FIPS mode on the PAN device?

Also which PANOS do you use?

I dont think PAN currently supports you to select (per ssl-decryption) which ciphers should be allowed but I would be glad if someone could file this as a feature request (I will do this myself but it seems that the more the better when it comes to how many reports the same feature request).

Re: SSL Weak CBC Mode Vulnerability

leole — Thu, 14 Feb 2013 23:27:32 GMT

Hi Johan,

How do you make your PA box passed the BEAST vulnerablity scan?

Thanks

Leo