We are using SecurityMetrics to test for PCI compliance and have recently started receiving a failure based on TCP/IP Initial Sequence Number (ISN) Reuse Weakness (CVE-2002-1463) for the PaloAlto firewall (5.0.8).
I'm not sure how to remedy the problem within the firewall. There have been no rule changes that should have caused this to start to occur but we have updated the firewall from previous release.
If the firewall is failing the test, we would need to get some more information about how you are testing the device and what the firewall is doing that causes it to fail. Both of the vulnerabilities are somewhat old and not modern firewall should be affected by them. We could create a zone protection profile, that gives you control over the how the firewall responds to specific packet based attacks.
The PAN-OS Administrator's Guide has some basic information about zone protection,
Here are two documents that explain how the Paloalto handles TCP connections,
Although, the above mentioned problem looking like a BUG-44798- Weak sequence number generation vulnerability on MP (management-plane) CVE-2011-3188 and CVE-2002-1463. This problem has been fixed in PAN OS 6.0.0.
Got a similar PCI DSS testing failure from pcicompliancemanager: CVE-2002-1463 BID : 5387, 8652 TCP/IP Initial Sequence Number (ISN) Reuse Weakness... Currently on PANOS 8.0.12 and find this highly suspect.. Any new details on this?
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!
The Live Community thanks you for your participation!