On 10/15/14, 10:17 AM, Jan Lieskovsky wrote:
> Hello folks,
>
> in relation to the recent SSLv3 CVE-2014-3566 / "POODLE" flaw:
> [1]
http://fedoramagazine.org/what-you-need-to-know-about-the-sslv3-poodle-fl...
>
> got wondering if there's anything SSG should do to react against it.
> Possibly to add / update system service rules checking for system SSL
> version that it is higher than SSLv3? [1] suggest httpd would be
> one candidate, but I am sure there would be more of them. Should this be
> investigated further & particular rules updated?
>
> Thanks && Regards, Jan.
> --
> Jan iankko Lieskovsky / Red Hat Security Technologies Team
>
> P.S.: For those possibly wondering the proposal is not to add rule checking
> particular package version is >= than the updated version disabling
> use of SSLv3 (IOW not to perform the CVE check itself). But rather
> check configuration of possibly affected system services, if they
> aren't using SSLv3 via their configuration files (since setting
> default SSL version higher than SSLv3 is one thing, but actually
> checking if that version isn't enabled again [by administrator] an another
one).
Already reflect using TLS for SMTP:
http://people.redhat.com/swells/scap-security-guide/RHEL/6/output/rhel6-g...
And using TLS for LDAP:
http://people.redhat.com/swells/scap-security-guide/RHEL/6/output/rhel6-g...
http://people.redhat.com/swells/scap-security-guide/RHEL/6/output/rhel6-g...
And using TLS for SSL:
http://people.redhat.com/swells/scap-security-guide/RHEL/6/output/rhel6-g...
And then specifically calls out using FIPS 140-2 certified ciphers,
which means the system forces protocols of TLSv1.1 and TLSv1.0 and
disables all other ciphers but the FIPS ones:
http://people.redhat.com/swells/scap-security-guide/RHEL/6/output/rhel6-g...
Big RHT has published some guidance for services such as Tomcat,
Firefox/Chrome, and httpd here:
https://access.redhat.com/articles/1232123
Pulling in the guidance for Apache makes sense... something like
>
> set the SSLProtocol directive as follows in /etc/httpd/conf.d/ssl.conf:
>
> *D**isable everything except TLSv1.x*
>
> On RHEL 7 or RHEL 6.6 and later:
>
> | SSLProtocol -All +TLSv1 +TLSv1.1 +TLSv1.2|
Just double checked the JBoss EAP guidance, has TLS written in:
" 2.14 - Ensure applications deployed by JBoss present valid DoD
certificates where applicable"
" 2.17 - Enable Federal Information and Processing Systems 140-2 (FIPS)
compliant cryptographic modules for use by JBoss Java environment"
" 5.5 - Do not transmit sensitive information over unsecured HTTP
connections"