Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 9 replies
  • Subscribers 4 subscribers
  • Views 2787 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

PCI Scan Failure - SPX TLS 1.0

ETFan

We're failing our PCI scan  after enabling and allowing the port for SPX email encryption. 

 

Details: A service supporting outdated versions of TLS or SSL was detected. TLS 1.0 and SSLv3 are affected by known flaws which could allow
man-in-the-middle attacks, such as
BEAST and
POODLE.

Information From Target:
Service: [port number]:TCP
Server accepted TLS 1.0 handshake with TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA cipher

 

How do we disable these weak ciphers for SPX?

SG 330 9.311-3

 

Thanks!



This thread was automatically locked due to age.
Parents
  • 0

    I'm amazed that your organization is only now failing it.  It appears that the last Up2Date applied, 9.311, was over three years ago, long before the BEAST and POODLE flaws were remediated.  The first thing you should do is apply Up2Dates through 9.605, following instructions in https://community.sophos.com/products/unified-threat-management/f/remote-ethernet-device-red/110908/solved-red15w-does-not-update-it-s-firmware-after-update-the-utm-to-9-601-5/411255#411255.

    I suspect that you will not be able to do that because your root partition is too full and will cause Up2Dating to fail.  As root at the command line, run df -h|head -2 and show us the result.  If the Use% is over 80%, also show us the result of ll /var/up2date/sys.

    If you're using the SMTP Proxy in Email Protection and the PCI scan fails because your minimum TLS Version is v1.1 or lower, let's work on that in a new thread in the Mail Protection forum.

    Once you've applied the Up2Dates, have the PCI scan run again.  Please let us know the result.

    Cheers - Bob
    PS You started this thread in the Web Server Security forum.  Are you indeed using the WAF, or is traffic to your servers handled with DNATs?  And, shouldn't I move this thread to the Email Protection forum?

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson

    We haven't needed SPX until now, PCI is only failing on the SPX port, I guess that's why we never noticed. As for being behind in firmware, that's an embarrassing lapse on our end. Our firmware has always said "Your firmware is up to date." I guess because we had the firmware download option set to manual? We were aware of POODLE, BEAST, etc and had those patched on all other major systems (mostly servers). 

     

    1. Used is only 55%. 

    2. We're only failing on the SPX port

    3. Not certain how I mistakenly posted here, we do not use WAF, you can move this. 

     

    Is that thread about the RED issue the one you meant to link? 

     

    Thanks for the quick response, and help!

     

Reply
  • 0 in reply to BAlfson

    We haven't needed SPX until now, PCI is only failing on the SPX port, I guess that's why we never noticed. As for being behind in firmware, that's an embarrassing lapse on our end. Our firmware has always said "Your firmware is up to date." I guess because we had the firmware download option set to manual? We were aware of POODLE, BEAST, etc and had those patched on all other major systems (mostly servers). 

     

    1. Used is only 55%. 

    2. We're only failing on the SPX port

    3. Not certain how I mistakenly posted here, we do not use WAF, you can move this. 

     

    Is that thread about the RED issue the one you meant to link? 

     

    Thanks for the quick response, and help!

     

Children
Unfiltered HTML