Vulnerabilities

[Guest]

[fackler]

I have been setting up EFW for evaluation for going into a production area and part of the eval is to run security scans on it.  So I run Nessus on the thing and come back with a disconcerting number of vulnerabilities for what is supposed to be a network securing device.  Here are some of the vulnerabilities:

80   tcp   HTTP Server           Medium   HTTP TRACE / TRACK Methods Allowed

3001   tcp   NTOP Server   Medium   SSL Medium Strength Cipher Suites Supported
                            Medium   SSL Weak Cipher Suites Supported
                            Medium   SSL Certificate Expiry
                            Medium   SSL Version 2 (v2) Protocol Detection

10443   tcp   HTTPS Server   Medium   SSL Weak Cipher Suites Supported
                            Medium   SSL Medium Strength Cipher Suites Supported


Whats the deal guys?  Did you forget to test your product against a vulnerability scanner?  Some of you may be thinking, "Yes, but those ports are only exposed internally."  I may end up having to use that excuse, er mitigating control, but that still presents me with something I have to convince my auditor about, and I don't like the implications towards real security.  I wouldn't be so grouchy if you didn't go and move all the furniture around though, what the heck did you do with ssl.conf? And how do I secure NTOP's little server?

[kcwhited]

I have a similar issue,  anyone know where to find ssl.conf would be appreciated 
not sure what you are looking for with NTOP though...

[fackler]

NTOP is where the "Traffic Graphs" page in the "Status" section comes from.  If you go to "Services"->"Traffic Monitoring"  then click on "Enable Traffic Monitoring"  you will activate the NTOP web server.  It is hosted at port 3001.  It will give you loads of nifty information about your network traffic.

I think that the only thing you turn off with the "Enable Traffic Monitoring" button is NTOP's web server because the "Status"->"Traffic Graphs" pages seems unaffected by turning off "Traffic Monitoring".  The problem with NTOP's little web server though is that they used a weak cipher suite and the certificate has expired.

So every time I scan the firewall I get those vulnerabilities.  It is uncomfortable to say the least when you are trying to explain to the security auditor why your primary network securing device has vulnerabilities like this.

So I guess the it comes down to: how do I update/change the SSL certificates for EFW's http interface and how do I do the same for NTOP's web server?