topic Vulnerability on our SMS in General Topics

Vulnerability on our SMS

gemechisd — Sat, 13 Jan 2024 07:56:03 GMT

We have scanned our SMS Server and found 2 vulnerablities. Can anyone suggest me how to fix them?

1. Weak Key Exchange (KEX) Algorithm(s) Supported (SSH)

The remote SSH server is configured to allow / support weak key exchange (KEX) algorithm(s).
Port 22/tcp

2. Weak Encryption Algorithm(s) Supported (SSH)

The remote SSH server is configured to allow / support weak encryption algorithm(s).
Port 22/tcp

Re: Vulnerability on our SMS

Chris_Atkinson — Sat, 13 Jan 2024 08:11:33 GMT

See the resources posted in reply to this discussion amongst others:

https://community.checkpoint.com/t5/Management/How-to-disable-weak-ssh-cipher-on-R80-40-R81-10/td-p/189713#M35893

Re: Vulnerability on our SMS

JozkoMrkvicka — Sat, 13 Jan 2024 11:46:37 GMT

Which KEX and MAC were identified as weak by the scanner?

Re: Vulnerability on our SMS

the_rock — Sat, 13 Jan 2024 13:45:37 GMT

I would say what @Chris_Atkinson gave is your solution. Btw, you can also run cipher_util from expert mode and see options available there.

Best,

Andy

Re: Vulnerability on our SMS

gemechisd — Mon, 15 Jan 2024 12:00:37 GMT

@JozkoMrkvicka

For KEX

- Disable the reported weak KEX algorithm(s)
1024-bit MODP group / prime KEX algorithms:
Alternatively use elliptic-curve Diffie-Hellmann in general, e.g. Curve 25519.

2. For MAC
Disable the reported weak encryption algorithm(s).