TCP Source Port Pass Firewall Vulnerability

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

TCP Source Port Pass Firewall Vulnerability

L4 Transporter

Hi Team,

 

We are getting below vulnerability in PA NGFW. 

 

Please find the error below, 

 

IP StatusQIDTitleTypeSeverityPortProtocolFQDNSSLCVE IDVendor ReferenceBugtraq IDCVSS BaseCVSS TemporalCVSS3 BaseCVSS3 TemporalThreatImpactSolutionExploitabilityAssociated MalwareResultsPCI VulnInstanceCategoryResult Errors
host scanned, found vuln34000TCP Source Port Pass FirewallVuln3       5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)3.6 (E:U/RL:W/RC:UC)Your firewall policy seems to let TCP packets with a specific source port pass through.Some types of requests can pass through the firewall. The port number listed in the results section of this vulnerability report is the source port that unauthorized users can use to bypass your firewall.Make sure that all your filtering rules are correct and strict enough. If the firewall intends to deny TCP connections to a specific port, it should be configured to block all TCP SYN packets going to this port, regardless of the source port.The host responded 4 times to 4 TCP SYN probes sent to destination port 25 using source port 25. However, it did not respond at all to 4 TCP SYN probes sent to the same destination port using a random source port.yes Firewall

 

 

 

Snow
1 REPLY 1

Cyber Elite
Cyber Elite

Make sure that all your filtering rules are correct and strict enough. If the
firewall intends to deny TCP connections to a specific port, it should be
configured to block all TCP SYN packets going to this port, regardless of the
source port.

 

Have you configured the FW to utilize PANW best practices for Zone and Dos Protections?

https://docs.paloaltonetworks.com/best-practices/10-0/dos-and-zone-protection-best-practices

 

 

Help the community: Like helpful comments and mark solutions
  • 4087 Views
  • 1 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!