NSS Labs Report - Mitigation for claimed vulnerabilities?

[networkadmin]

Seriously? | NSS Labs

Could someone elaborate on the section which says:

All PAN-OS devices require a configuration change to detect even the most basic TCP stream segmentation evasions. The “Mismatched overlapping TCP segment” protection in the Zone Protection profile is not enabled by default, which allows attackers to bypass the device completely using TCP stream segmentation with overlapping data evasion techniques. NSS strongly recommends that this protection is always enabled – any PAN customer that has not checked this box is at extreme risk.

I've not come across this and would like to know if it's suggested to enable it?

[ssharma]

Hi NetworkAdmin,

You can find following document to answer some of your question:

Response to Recently Released 2014 NSS Next-Generation Firewall Comparative Analysis - Palo Alto Net...

Thank you.

[mrsoldner]

I had thought about posting that same report in hopes of seeing / hearing other thoughts.

This video was also ... interesting to say the least.

Note:  I understand this appears to be a CheckPoint smear channel, it's still interesting to see the vulnerability.  

Palo Alto Netowrks IPS evasion DEMO - NSS Labs - YouTube

[lios]

Nothing new (2010):

Advanced evasion techniques - Laboratory demonstration - YouTube

[lios]

Hello,

I have tried attack which is shown in previously mentioned video (Palo Alto Netowrks IPS evasion DEMO - NSS Labs - YouTube) and it was not successful over PA. It looks like PA (6.0.5, app&threat 459-2387) is blocking all segmented SMB traffic.

[lios]

ask PA

[lios]

I have to add that all I tried was conficker attack using single "smb_seg" evasion as shown in video which was stopped using signature not normalization. I haven't ran Evader in Automatic Evasions mode for 12 hours as shown in video..

Strangely some messages from hshah and one from me disappeared in this thread.

Hi Lios,

Thanks for inputs. As I said PANW first gathers all fragemetns, IF any fragment is
missing or overlapping than it simply drops all fragments.

Regards,
Hardik Shah

Then I wrote that it looks like PA is blocking ANY fragmented SMB traffic not just with missing or overlapping fragments.

Hi Lion,

That might be true.

Regards,
Hardik Shah

Interesting, why would it block genuine fragments ?

My response (ask PA) is still here..

[lios]

By the way, new video:

PAN Evasion Bypass take 2 - With PAN Best Practices implemented - YouTube

[panos]

Customer advisory - Palo Alto Networks provides coverage for 2 security evasions

[lios]

Palo Alto Networks IPS Evasion Bypass After NSS Labs Patch 6.0.5h3 - YouTube

[panos]

So;  the fixes are not enough ?