How to disable LUCKY13 (CVE-2013-0169) PureFTP

JIKOmetrix

• March 20, 2019 08:01

Hello, My Merchant provider did a PCI scan and I was asked to fix a few things. During my testing before rescanning for PCI comp I saw mention of: LUCKY13 (CVE-2013-0169), experimental potentially VULNERABLE, uses cipher block chaining (CBC) ciphers with TLS. Check patches I was testing with testssl.sh ./testssl.sh --starttls ftp 144.xxx.zzz.xxx:21 How do I disable the LUCKY13 cipher in PureFTP? Is it as simple as adding !LUCKY13 to the cipher list? I currently have the cipher suite set as "HIGH:+TLSv1:!SSLv2:+SSLv3:!aNULL:!eNULL" Thanks, Mike

• 

  cPanelLauren

  • March 21, 2019 19:46

  I believe this was handled in the other thread here:

  0
• 

  JIKOmetrix

  • March 21, 2019 19:49

  Yes, I did not know how to remove this one. Sorry for double post.

  0
• 

  cPanelLauren

  • March 21, 2019 20:12

  No worries, I just wanted to make sure there wasn't still a continuing issue! Thanks!

  0

Please sign in to leave a comment.