topic Re: PAN-SA-2017-0010 - INFORMATION DISCLOSURE IN THE MANAGEMENT WEB INTERFACE in General Topics

PAN-SA-2017-0010 - INFORMATION DISCLOSURE IN THE MANAGEMENT WEB INTERFACE

Diego.Montoya — Wed, 19 Apr 2017 16:20:01 GMT

Hello

I detected a bug PAN-SA-2017-0010 - INFORMATION DISCLOSURE IN THE MANAGEMENT WEB INTERFACE in the environment palo alto that I support . would you give me some recommendation/workaround ?

Re: PAN-SA-2017-0010 - INFORMATION DISCLOSURE IN THE MANAGEMENT WEB INTERFACE

BPry — Wed, 19 Apr 2017 16:24:00 GMT

Update to 7.1.9 or higher.

Limit the management interface to only those IPs that actually need it.

The attacker needs to be authenticated in the management interface, so don't give people access that you don't trust.

Restrict access to a set time schedule.

Re: PAN-SA-2017-0010 - INFORMATION DISCLOSURE IN THE MANAGEMENT WEB INTERFACE

Diego.Montoya — Wed, 19 Apr 2017 16:26:26 GMT

Could you provide me the appropiate steps to carry out the recommendations?

Re: PAN-SA-2017-0010 - INFORMATION DISCLOSURE IN THE MANAGEMENT WEB INTERFACE

BPry — Wed, 19 Apr 2017 21:16:06 GMT

@Diego.Montoya,

Access to the management IP can be restricted by clicking on the gear icon on the management interface settings on the Devices Mangement settings like pictured below.

You could setup an access schedule as long as your management network traffic traverses your firewall and requires that your security policy allowing access to that IP address gets assigned a Schedule to limit the times that the management network is allowed. If you put access on a schedule I would recommend leaving your Network Operations computers off of this scheduled access policy so that they can work on the device whenever needed.

If you have management enabled on your actual interfaces and not your management interface then you can still restrict that access to set IP addresses; you just need to modify your Interface Mgmt profile to include listed 'Permitted IP Addresses' so that it doesn't allow everything like it does by default.

Hope that helps.