Security Vulnerability for Webcache -- SSL Weak Cipher Suites Supported

SSL Vulnerability with Webcache with SSL Weak Cipher


Following is one of the reports from Nessus.

SSL Weak Cipher Suites Supported

Synopsis:
The remote service supports the use of weak SSL ciphers.

Description:
The remote host supports the use of SSL ciphers that offer either weak encryption or no encryption at all. Note: This is considerably easier to exploit if the attacker is on the same physical network.

Risk factor:
Medium

CVSS Base Score:4.3
CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N

See also:
http://www.openssl.org/docs/apps/ciphers.html

Solution:
Reconfigure the affected application if possible to avoid use of weak ciphers.


This is usually reported from your security scanner.
It does not matter if you have a strong encryption with 128 bit, it all depends on your SSL Cipher version supported. In security it is said that with a weak SSL cipher version server is still vulnerable to attacks.

There are 3 types of SSL Version,

SSL 2.0, 3.0 and 3.1 or TLS. TLS stands for Transport Layer Security. SSL 2.0 which is the oldest version supported is considered as weak and needs to be disabled.

To get rid of the error first check if your SSL port,

Go to your webcahe home and opmn.

$ORACLE_HOME/opmn/bin/opmnctl status -l

-------------------+--------------------+---------+----------+------------+----------+-----------+------
ias-component      | process-type       |     pid | status   |        uid |  memused |    uptime | ports
-------------------+--------------------+---------+----------+------------+----------+-----------+------
HTTP_Server        | HTTP_Server        |  933924 | Alive    |  327877050 |     9056 |  00:40:56 | http1:7778,http2:7200
LogLoader          | logloaderd         |     N/A | Down     |        N/A |      N/A |       N/A | N/A
dcm-daemon         | dcm-daemon         |     N/A | Down     |        N/A |      N/A |       N/A | N/A
OC4J               | home               | 1941518 | Alive    |  327877051 |    42648 |  00:40:58 | ajp:12508,rmi:12408,jms:12608
WebCache           | WebCache           | 3408104 | Alive    |  327877052 |   700644 |  00:40:58 | http:7777,invalidation:9401,statistics:9402,https:443,http_1:80
WebCache           | WebCacheAdmin      | 1200336 | Alive    |  327877053 |    18860 |  00:40:58 | administration:9400
DSA                | DSA                |     N/A | Down     |        N/A |      N/A |       N/A | N/A


In my case my https port is 443.

Now use the following command and check if SSLv2 is used.

openssl s_client -ssl2 -connect localhost:443
CONNECTED(00000003)
This gets connected with SSL version v2, it means that SSL 2.0 is enabled and the server is vulnerable to attacks.

To disable SSL 2.0,

Open webcache.xml under $ORACLE_HOME/webcache.

Modify the line below,

 <LISTEN IPADDR="ANY" PORT="443" PORTTYPE="NORM" SSLENABLED="SSLV3_V2H" CLIENT_CERT="NO" STRONG_CRYPTO_ONLY="NO" Key="IPADDR PORT">

to

 <LISTEN IPADDR="ANY" PORT="443" PORTTYPE="NORM" SSLENABLED="SSLV3" CLIENT_CERT="NO" STRONG_CRYPTO_ONLY="NO" Key="IPADDR PORT">

Here I have modified SSLENABLED="SSLV3_V2H" to SSLENABLED="SSLV3"


Once the file is modified restart your webcache component.

opmnctl restartproc process-type=WebCache

Now test if SSL 2.0 has been disabled with the same command,

openssl s_client -ssl2 -connect localhost:443
CONNECTED(00000003)
1576972:error:1407F0E5:SSL routines:SSL2_WRITE:ssl handshake failure:s2_pkt.c:428:


This has wored and you see an handshake failure on port 443.