On 2/28/2013 6:27 PM, Chaim | Sz Studios wrote:
BH
Hi All,
I'm trying to pass a pci scan, I'm on Ubuntu 12.04 lts server and Nginx.
I've tried everything I know and did a lot of research... apparently
seems that need to disable a setting in OpenSSL which I can't find how
to do.
This is the result of the scan:
SSL/TLS Protocol Initialization Vector Implementation Information
Disclosure Vulnerability www (443/tcp)
CVSS Score: Medium 4.3
Fail
CVE-2011-3389
and this is the suggested fix:
Configure SSL/TLS servers to only use TLS 1.1 or TLS 1.2 if supported.
Configure SSL/TLS servers to only support cipher suites that do not use
block ciphers. Apply patches if available.
OpenSSL uses empty fragments as a countermeasure unless the
'SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS' option is specified when OpenSSL is
initialized.
I don't know how to do this, please help.
Note: tlsv1.1 and tlsv1.2 are not supported. I upgraded to latest
verions of all (Ubuntu, nginx and openssl) which I read it takes care of
the tls being not supported by default. But I'm getting the exact same
report from the scan.
Been through the similar exercise recently.
1. In the Aptitude package manager gui, make sure the installed libssl*
package is version 1.0.1 or later.
2. Still in Aptitude, make sure the Apache2 package you use depends on
that libssl package, indicating that it is actually compiled to use
OpenSSL 1.0.1
3. Check the changelogs in /usr/share/apache2/changelog.Debian.gz and
/usr/share/libssl*/changelog.Debian.gz to check if either includes
a workaround for Apache mod_ssl assuming SSL_OP_ALL is safe to use while
OpenSSL 1.0.1 (stupidly) includes SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
in SSL_OP_ALL by default.
In my case (it was another web server package, not apache2), I ended
up doing local compiles of both OpenSSL 1.0.1e and the web server code
to get #3 right.
Enjoy
Jakob
--
Jakob Bohm, CIO, Partner, WiseMo A/S. http://www.wisemo.com
Transformervej 29, 2730 Herlev, Denmark. Direct +45 31 13 16 10
This public discussion message is non-binding and may contain errors.
WiseMo - Remote Service Management for PCs, Phones and Embedded
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [email protected]
Automated List Manager [email protected]
