Vendors patch firewalls after controversial NSS Labs test

NSS Labs has now accepted the vendors' patches for the flaws they initially denied existed

Four out of the five vendors shown last month by testing company NSS Labs to suffer a security flaw in their high-end firewalls have since patched their products, including two companies that disputed the issue at the time.

A statement released by NSS Labs confirmed that Fortinet, SonicWALL and Palo Alto Networks had now updated their products to fix the TCP split handshake issue revealed on April 12, while Juniper Networks had addressed it by altering the product's default setting.

One company, Cisco, has yet to issue a patch but recommended a workaround using access control lists that avoided the issue in some but not all cases.

In the days after publication, the NSS Labs tests proved controversial, with one company, Fortinet, disputing the significance of the flaw with the claim that the issue could be prevented by turning on the company's separate intrusion prevention system (IPS) and antivirus security modules.

"NSS Labs incorrectly states that Fortinet does not currently provide customers with protection against a TCP split handshake," said Fortinet's VP of product marketing, Patrick Bedwell, at the time.

"We feel strongly that integrated protection is the best approach for blocking this issue, as customers that have IPS working with their firewall are better protected against a wider range of threats," said Bedwell.

The tests also upset SonicWALL. "This claim [the TCP split handshake attack vulnerability] is not correct since SonicOS has had the referenced TCP Split Handshake Spoof protection since SonicOS 3.0 released in 2004. Regrettably, NSS chose not to enable it for their testing despite our insistence on it being enabled for proper results," said company PR Director Jock Breitwieser.

Although neither company denied the likelihood of a patch being necessary, that they have been issued rapidly suggests a calmer assessment of the NSS tests now that the heat of the moment has passed.

"Only this kind of rigorous, unsponsored testing could have uncovered these types of critical issues. Product quality is a big issue in the security industry," said NSS Labs head Rick Moy. "That most vendors are ultimately fixing the problem validates our work, despite a vendor's initial marketing response."

The affair could yet turn out to be a significant moment for the security appliance industry. There has been criticism in the past that vendors have over-relied on product testing that was not independent enough to reveal important security issues to the businesses that buy the products. The NSS Labs firewall tests were sponsored by unnamed financial services companies and not vendors.

The five firewalls affected by the TCP split handshake flaw were the Fortinet Fortigate 3950 series, SonicWall NSA E8500, Palo Alto Networks PA-4020, Juniper SRX5800 and Cisco ASA 5585-40. Only one product looked at, Check Point's Power-1 11065, did not suffer from the flaw. Patching advice can be found through each vendor's Web support system, although NSS Labs has advised companies to test the patches carefully first.

"Enabling this protection may have a negative impact on performance and/or break applications that are not using TCP properly," said NSS Labs in its statement.

Join the CSO newsletter!

Error: Please check your email address.

Tags NSS Labsfirewallssecurity

More about ASACheck Point Software TechnologiesCiscoEnablingFortinetIPSJuniperJuniperNSAPalo Alto NetworksSonicWallSonicWall

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by John E. Dunn

Latest Videos

  • 150x50

    CSO Webinar: Will your data protection strategy be enough when disaster strikes?

    Speakers: - Paul O’Connor, Engagement leader - Performance Audit Group, Victorian Auditor-General’s Office (VAGO) - Nigel Phair, Managing Director, Centre for Internet Safety - Joshua Stenhouse, Technical Evangelist, Zerto - Anthony Caruana, CSO MC & Moderator

    Play Video

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

More videos

Blog Posts

Market Place