CVE-2004-2761 and CVE-2008-5161 vulnerability applicable to PAN 7.0.3

balamurugan.manavalan — Sun, 19 Jun 2016 04:26:34 GMT

Hi all,

Hope everyone doing great.

I have a Palo alto firewall running in 7.0.3 version. Recently there was an audit happened and submitted some vulnerabilities found in our firewall. I am very curious to know that whether captioned vulnerability appiicable to PAN 7.0 or not.

Below are the description for the vulnerabilities:

• SSL Certificate Signed Using Weak Hashing Algorithm
• SSH Weak Algorithms Supported (medium)
• SSH Weak MAC Algorithms Enabled
• SSH Server CBC Mode Ciphers Enabled

Thanks.

Bala

Re: CVE-2004-2761 and CVE-2008-5161 vulnerability applicable to PAN 7.0.3

reaper — Tue, 21 Jun 2016 07:27:11 GMT

Was this scan performed on the management interface or 'through' the firewall to see what it would block ?

The default management interface certificate should be SHA1-RSA128, but you could opt to generate/install a more robust certificate

fot ssl/tls passing through the firewall, you can configure your decryption profile to allow only stronger encryption and enable threat prevention to block weak cyphers or block vulnerabilities

topic CVE-2004-2761 and CVE-2008-5161 vulnerability applicable to PAN 7.0.3 in General Topics

CVE-2004-2761 and CVE-2008-5161 vulnerability applicable to PAN 7.0.3

Re: CVE-2004-2761 and CVE-2008-5161 vulnerability applicable to PAN 7.0.3