CVE-2004-2761 and CVE-2008-5161 vulnerability applicable to PAN 7.0.3

[balamurugan.manavalan]

Hi all,

Hope everyone doing great.

I have a Palo alto firewall running in 7.0.3 version. Recently there was an audit happened and submitted some vulnerabilities found in our firewall. I am very curious to know that whether captioned vulnerability appiicable to PAN 7.0 or not.

Below are the description for the vulnerabilities:

• SSL Certificate Signed Using Weak Hashing Algorithm
• SSH Weak Algorithms Supported (medium)
• SSH Weak MAC Algorithms Enabled
• SSH Server CBC Mode Ciphers Enabled

Thanks.

Bala

[reaper]

Was this scan performed on the management interface or 'through' the firewall to see what it would block ?

The default management interface certificate should be SHA1-RSA128, but you could opt to generate/install a more robust certificate

fot ssl/tls passing through the firewall, you can configure your decryption profile to allow only stronger encryption and enable threat prevention to block weak cyphers or block vulnerabilities