PCI Compliance Test Failed – CVE-2009-3555

[Jack_Gerbs]

Just had an external scan performed on our network? The Fortigate 50B failed because of CVE-2009-3555, which is a TLS Protocol Session Renegotiation Security Vulnerability. We are running 4.0MR3P10. I looked at new patches, and none of them address this. Any suggestions? Thanks, Jack

[Dave_Hall]

Both 4.0 MR3 and 5.0 handbook has this to say on the topic...

[Jack_Gerbs]

I found this info, but this 50B does not seem to have this setting. IT is running 4MR3P10. The 50B can' t take v5. Thanks,

[emnoc]

That' s probably a issues with your VPNssl and the the settings is under your config vpn ssl setting And has nothing todo with a VIP per se. btw my fwf50b does not support that cmd but this one; fwf50b (settings) # set allow-unsafe-legacy-renegotiation and version; fwf50b # get system status | grep Ver Version: FortiWiFi-50B v4.0,build0656,130211 (MR3 Patch 12) Release Version Information: MR3 Patch 12 Also you can check if reneg is support ; openssl s_client -connect x.x.x.x:10443 | grep Reneg depth=1 /C=US/ST=California/L=Sunnyvale/O=Fortinet/OU=Certificate Authority/CN=support/emailAddress=support@fortinet.com verify error:num=19:self signed certificate in certificate chain verify return:0 Secure Renegotiation IS supported <--------