Palo Alto Vulnerability Points (Urgent Action Required)

[Sethupathi]

Hi Team,

Can anyone provide your valuable suggestion here please.

Below are the VAPT points shared by customer and solution provided :

PA Vulnerability points (For reference please find attached pdf) :
1) ssl/tls protocol initialization vector implementation information disclosure vulnerability (BEAST) - SSL/tls profile needs to be configure for firewall mgmt access. SSL/TLS version we can keep from TLS1.1 to TLS 1.2
2) ssl/tls protocol initialization vector implementation information disclosure vulnerability (BEAST) - SSL/tls profile needs to be configure for firewall mgmt access. SSL/TLS version we can keep from TLS1.1 to TLS 1.2
3) SSL self-signed certificate - Purchase a certificate
4) ssl certificate cannot be trusted - Purchase a certificate
5) ssl certificate cannot be trusted - Purchase a certificate
6) SSL medium strength cipher suites supported(sweet32) - ECDSA certificate configure in Firewall
7) SSL certificate siged using weak hashing algorithm - ECDSA certificate configure in Firewall
😎 SSH weak algorithm supported - enable only GCM and CTR ciphers , only applicable above 8.0 version
9) HSTS missing from HTTPS server - Need to check with tac
10) HSTS missing from HTTPS server - Need to check with tac
11) HTTP Methos allowed (per directory) - Need to check with tac
12) HTTP Methos allowed (per directory) - Need to check with tac
13) SSH server CBC mode ciphers enabled - enable only GCM and CTR ciphers , only applicable above 8.0 version
14) SSH weak mac algorithm enabled - we can disable ssh weak mac algorithm , only applicable above 8.0 version

Please correct if anything wrong.

Software Version 7.1.21
Model PA-500

Please help us here to provide solution of following questions if anyone knows,

9) HSTS missing from HTTPS server - ?
10) HSTS missing from HTTPS server - ?
11) HTTP Methos allowed (per directory) - ?
12) HTTP Methos allowed (per directory) - ?

Regards,

Sethupathi M

[reaper]

thats 2x the same question ? could you add some more details? If something is missing from the server, you'll want to check the server, same for the http methods allowed per directory