Palo Alto Reponse to CVE-2023-48795

[Black_Sunglass]

Hi all! I am curious whether  anyone knows if Palo Alto has any made any response to CVE-2023-48795? This vulnerabilities has been out for awhile and other vendors have already provided some types of response however, I am not able to find one from Palo Alto. 

FYI, CVE-2023-48795 also known as Terrapin which is found in the SSH protocol and affects SSH channel integrity, details refer to link below:

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-48795

https://terrapin-attack.com/

Response to CVE-2023-48795 from other vendors 

https://support.checkpoint.com/results/sk/sk181833

https://alas.aws.amazon.com/cve/html/CVE-2023-48795.html

[Usama-Ahmed]

I don't see a response on this but researching. 

[hamzah_pinadi]

Hi,

security.paloaltonetworks just updated with this CVE:

https://security.paloaltonetworks.com/CVE-2023-48795

"Customers can resolve this issue by removing support for CHACHA20-POLY1305 and all Encrypt-then-MAC algorithms available (ciphers with -etm in the name) in PAN-OS software. Guidance on how to configure strong ciphers and algorithms can be found on the following pages:

- https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000004OOQCA2

- https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-cli-quick-start/get-started-with-the-cli/refres...

This issue is completely resolved by following the recommended best practices for deploying PAN-OS (https://docs.paloaltonetworks.com/best-practices/10-1/administrative-access-best-practices/administr...). No additional PAN-OS fixes are planned in maintenance releases at this time."

[Usama-Ahmed]

Thanks for the update. 

[Rajendra-S]

May we know about CHACHA20-POLY1305 Cipher.
how can we check in CLI or WEB interface.
how do we enable to disable this?

[Usama-Ahmed]

Hi Rajendra:

You can run the below command from a linux machine against the firewall or Panorama:

nmap --script ssh2-enum-algos -sV -p 22 <firewall IP>

That will tell you what ciphers are running on the device. Instructions on that are in this article:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000kF2eCAE&lang=en_US%E2%80%A...

Once you have that information. You can use the article below to disable the undesired ciphers:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000004OOQCA2

To alleviate CVE-2023-48795 my understanding is that you need to disable ciphers with -etm in the name. Which if you are on PAN-OS 10.1 would be the below list for MAC algorithms:

     umac-64-etm@openssh.com

|       umac-128-etm@openssh.com

|       hmac-sha2-256-etm@openssh.com

|       hmac-sha2-512-etm@openssh.com

|       hmac-sha1-etm@openssh.com

You should also see in PAN-OS 10.1 in encryption algorithms that you need to disable:

chacha20-poly1305@openssh.com

You can disable more weak ciphers as per your organizational standard to further harden. 

Reminder, when you use an SSH service profile it becomes an allow list of ciphers, and everything else is blocked. 

Note: You will have to restart the management SSH service from the CLI to apply the profile using the command "set ssh service-restart mgmt". It is recommended to do that after hours. 

[Rajendra-S]

Hello Usman Ahmed,

Thank you for your response.

Is there any way to check from a Windows or MAC machine?