Port 5001

[jk326598]

Hello,

In order to stop failing PCI compliance tests, I had to close down port 5001 on our firewall. This of course makes the web client inaccessible from the outside and the desktop and mobile app function with less capability (no presence or contacts).

Is there a recommended way to resolve this? Move to 443 maybe? PCI exemptions?

Thanks in advance.

 

[NickD_3CX]

Hi @jk326598 ,

This really depends on what exactly the PCI compliance test failed on.
Could you give some more information about what the auditors didn't like about 5001 being open?

 

[jk326598]

Hi @jk326598 ,

This really depends on what exactly the PCI compliance test failed on.
Could you give some more information about what the auditors didn't like about 5001 being open?

The failure was the goldendoodle vulnerability. Here is the exact verbiage:

GOLDENDOODLE vulnerability found with ECDHERSA-
AES256-SHA384 on TLSv1.2
The server returns valid data in response to valid pa
dding with an invalid MAC

Closing 5001 resolved the PCI issue.

 

[NickD_3CX]

Then I think you need to review this post that is about the same thing:
https://www.3cx.com/community/threads/cve-2019-1559.87335/

 

[jk326598]

Then I think you need to review this post that is about the same thing:
https://www.3cx.com/community/threads/cve-2019-1559.87335/

I had seen that thread and did confirm the anti hacking box was checked. Also upgraded one of the systems from v16 to v18. So is the answer that we need to ask for an exception/exemption on the scan?

 

[NickD_3CX]

I had seen that thread and did confirm the anti hacking box was checked. Also upgraded one of the systems from v16 to v18. So is the answer that we need to ask for an exception/exemption on the scan?

The answer is what is said here: https://www.3cx.com/community/threads/cve-2019-1559.87335/post-413795

To summarize it, isolating the Cipher, yes it can be a "weak link", but in the context that we are using it, you are safe.
Also we are following the best practices and still get A+ on Qualys.

It also explains why we don't go full strict, because apart from security, we have to ensure broad compatibility with a lot of other hardware vendors, as well as older hardware (as much as we can at least), so we try to find perfect balance between the 2.

If you have any concerns though about your 3CX installation, you can always reach out to [email protected] .