----- Original Message -----
From: "Shawn Wells" <shawn(a)redhat.com>
To: scap-security-guide(a)lists.fedorahosted.org
Sent: Wednesday, October 15, 2014 7:07:45 PM
Subject: Re: SSG reaction wrt to "POODLE" CVE flaw required?
On 10/15/14, 10:17 AM, Jan Lieskovsky wrote:
Hello folks,
in relation to the recent SSLv3 CVE-2014-3566 / "POODLE" flaw:
[1]
http://fedoramagazine.org/what-you-need-to-know-about-the-sslv3-poodle-fl...
got wondering if there's anything SSG should do to react against it.
Possibly to add / update system service rules checking for system SSL
version that it is higher than SSLv3? [1] suggest httpd would be
one candidate, but I am sure there would be more of them. Should this be
investigated further & particular rules updated?
Thanks && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team
P.S.: For those possibly wondering the proposal is not to add rule checking
particular package version is >= than the updated version disabling
use of SSLv3 (IOW not to perform the CVE check itself). But rather
check configuration of possibly affected system services, if they
aren't using SSLv3 via their configuration files (since setting
default SSL version higher than SSLv3 is one thing, but actually
checking if that version isn't enabled again [by administrator] an
another one).
Already reflect using TLS for SMTP:
http://people.redhat.com/swells/scap-security-guide/RHEL/6/output/rhel6-g...
And using TLS for LDAP:
http://people.redhat.com/swells/scap-security-guide/RHEL/6/output/rhel6-g...
http://people.redhat.com/swells/scap-security-guide/RHEL/6/output/rhel6-g...
And using TLS for SSL:
http://people.redhat.com/swells/scap-security-guide/RHEL/6/output/rhel6-g...
And then specifically calls out using FIPS 140-2 certified ciphers, which
means the system forces protocols of TLSv1.1 and TLSv1.0 and disables all
other ciphers but the FIPS ones:
http://people.redhat.com/swells/scap-security-guide/RHEL/6/output/rhel6-g...
Great to hear these are handled.
Big RHT has published some guidance for services such as Tomcat,
Firefox/Chrome, and httpd here:
https://access.redhat.com/articles/1232123
Pulling in the guidance for Apache makes sense... something like
set the SSLProtocol directive as follows in /etc/httpd/conf.d/ssl.conf: D
isable everything except TLSv1.x
On RHEL 7 or RHEL 6.6 and later:
SSLProtocol -All +TLSv1 +TLSv1.1 +TLSv1.2
Ok, will prepare that PR.
From:
http://askubuntu.com/questions/537196/how-do-i-patch-workaround-sslv3-poo...
looks like dovecot might be good candidate yet(IMHO not exposed that much
since might not be necessarily be able to evaluate that JavaScript required
for performing MiTM attack. But better to be safe than sorry).
For the rest of the services from above link we should be safe (sendmail
is recommended to be un-installed / disabled). The rest is either safe or
not shipped.
Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team