PCI Compliance Azure Websites (CVE-2014-6321)

Question

Trying to gain PCI compliance of an azure website. Trustwave scan came back as a pass apart from the following:-

Vulnerability in Security Channel Could Allow Remote Code Execution (MS14-066)/CVE-2014-6321

Anything I can do? It's post 443 - we have a EV SSL certificate in IP Based SSL.

Answer 1

What scanner are you using? I just checked and we do have our front ends patched for the SChannel vulnerability (KB 2992611) already, so I am not sure how it is detecting this.

Answer 2

Ignore, the scanner question ... I see it is Trustwave. I am getting in touch with them to see how they are detecting this and will post on this thread when I hear from them.

Answer 3

I just had a conversation with Trustwave and they are going to disable this check while they figure out a detection without this false positive, so your scans should be fine now. Thank you Trustwave for such a quick response and turn around!

Answer 4

Thanks Nazim - I'll re-run the scan now. S

Answer 5

Yes, that worked. Thanks