Question About PA SSL vulnerability

Reply
Highlighted
L3 Networker

Question About PA SSL vulnerability

Hello Team,

 

Can anyone provide a solution resolve below vulnerability in PA.

 

Port no.: 443

 

Summary: Weak cipher suites supported

 

Analysis :The remote host running SSL using a weak cipher suite which can be exploited by an attacker to perform man in the middle attacks. All the updated and secured services will be transmitting data over the unencrypted channel.

Attacker can obtain the keys with factorization in short amount of time. Also vulnerable to various cryptographic flaws like POODLE attack or MITM attack.

 

Recommendations: Remove the weak or guessable cipher suites

 

Could you please help us here to fix an issue.

 

Note: PAN-OS 8.0. Platform

 

Regards,

Sethupathi M

L4 Transporter

Re: Question About PA SSL vulnerability

Is this when accessing the web UI for managing the firewall?  If so, it's an easy fix:

  - Device tab --> Certificate Management --> SSL/TLS Service Profile

  - click on the profile that you use for the web interface (as specified under Device tab --> Setup --> Management sub-tab)

  - change the Min Version to TLSv1.2

  - click OK

  - commit the change

 

Run the vulnerability scanner again, and it shouldn't show up anymore.

 

If this is for something else, you'll need to provide more details.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!