Solved

PCI scan failed due to Beast exploit on port 443 and 10442

Posted on 2013-01-04
5
2,217 Views
Last Modified: 2013-01-09
We had a PCI scan done and they checked the IP of the firewall and comes back with problems with port 443 and 10443 (SSL VPN) and the remidition is:

Affected users should disable all block-based cipher
suites in the server's SSL configuration and only support
RC4 ciphers, which are not vulnerable to fully address
this vulnerability. This vulnerability was addressed in
TLS version 1.1/1.2, however, support for these newer
TLS versions is not widely supported at the time of this
writing, making it difficult to disable earlier versions.
Additionally, affected users can also configure SSL to
prefer RC4 ciphers over block-based ciphers to limit, but
not eliminate, exposure. Affected users that implement
prioritization techniques for mitigation as described
above should appeal this vulnerability and include
details of the SSL configuration.


I have Fortigate 80CM and don't see where I can change that. I have disabled HTTPS mgmt on the interface and disabled SSL VPN so that should take care of this. However if I NMAP on those two ports it still shows as filtered unknown or udp open

PORT      STATE         SERVICE VERSION

10443/tcp filtered      unknown

10443/udp open|filtered unknown

Too many fingerprints match this host to give specific OS details

I also created a firewall rule to block traffic from any to that WAN IP on port 10443 and 443 and still shows as filtered

Or is there a way to change to RC4 encryption so Trustwave's PCI scan doesn't find that vulnerability?
0
Comment
Question by:piotrmikula108
  • 3
  • 2
5 Comments
 
LVL 12

Expert Comment

by:aindelicato
ID: 38745257
Have you tried filing an exception showing screenshots of the service disabled and FW rule denying traffic to those ports?
0
 
LVL 1

Author Comment

by:piotrmikula108
ID: 38745273
I will do that after running a new scan, should be done soon
0
 
LVL 12

Expert Comment

by:aindelicato
ID: 38745291
I've come to learn that I can't make EVERY vulnerability disappear from scan reports.  So if I've exhausted all my resources, I file an exception with supporting documentation.
0
 
LVL 1

Accepted Solution

by:
piotrmikula108 earned 0 total points
ID: 38745385
new scan PASSSed, looks like what I did prevents the exploits
0
 
LVL 1

Author Closing Comment

by:piotrmikula108
ID: 38758264
new scan PASSSed, looks like what I did prevents the exploits
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

A brand new malware strain was recently discovered by security researchers at Palo Alto Networks dubbed “AceDeceiver.” This new strain of iOS malware can successfully infect non-jailbroken devices and jailbroken devices alike.
How to set-up an On Demand, IPSec, Site to SIte, VPN from a Draytek Vigor Router to a Cyberoam UTM Appliance. A concise guide to the settings required on both devices
This tutorial gives a high-level tour of the interface of Marketo (a marketing automation tool to help businesses track and engage prospective customers and drive them to purchase). You will see the main areas including Marketing Activities, Design …
Many functions in Excel can make decisions. The most simple of these is the IF function: it returns a value depending on whether a condition you describe is true or false. Once you get the hang of using the IF function, you will find it easier to us…

911 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now