How to disable the use of SSL compression on HTTP-TLS interfaces on the device.

[aniz.mohammed@futuretec.com.kw]

Dear All,

Please help me on this issue. The IT Security Audit team has scanned the PaloAlto Firewall PA-2050 and they found this vulnerability:

*********************************************************************************************************

62565 (1) - TLS CRIME Vulnerability

Synopsis:

The remote service has a configuration that may make it vulnerable to the CRIME attack.

Description:

The remote service has one of two configurations that are known to be required for the CRIME attack:

- SSL / TLS compression is enabled.

- TLS advertises the SPDY protocol earlier than version 4.

Solution:

Disable compression and / or the SPDY service.

Risk Factor:

Medium

*********************************************************************************************************

According to the document from PaloAlto "PAN-OS 5.0.3: Release Notes > Addressed Issues"  there is:

47813 -- Made a change to disable the use of SSL compression on HTTP-TLS interfaces on the device.

So, How can we disable this SSL compression?

Regards,

Aniz

[kadak]

Hello Aniz,

SPDY feature can be disabled in Chrome's browser properties.

Please refer the following document:

Chrome Version 21 Unable to Make SSL Connections to google.com Destinations

Let me know if that helps you!

Thanks and regards,
Kunal Adak