TLS 1.2 Poodle Vulnerability for WHM and Cpanel Ports

jestep

• June 23, 2020 10:31

Just started failing PCI on a server for a poodle vulnerability for WHM and Cpanel ports, 2083 and 2087. CVE's are: 2015-4078 2014-8730 2015-5369 This server has been running for years right now with very few changes. I don't see these when I grep the openssl changelog. Is there somewhere else I need to look to show these were patched or did I miss a big security issue with TLS 1.2? Kind of scratching my head on this one, none of my other servers are failing it... Even though all servers are running identical operating systems and SSL/TLS and identical cipher implementations, the description from trustwave is: Certain TLS implementations do not properly conform to the TLS RFC and support the CBC padding scheme from SSLv3. This could allow an attacker to exploit a padding-oracle and compromise the confidentiality of a TLS session.

• 

  cPanelLauren

  • June 24, 2020 23:33

  None of these CVE's seem relevant to standard CentOS/RHEL installations. The details on each of them are here:

  Description

  Pulse Connect Secure (aka PCS and formerly Juniper PCS) PSC6000, PCS6500, and MAG PSC360 8.1 before 8.1r5, 8.0 before 8.0r13, 7.4 before 7.4r13.5, and 7.1 before 7.1r22.2 and PPS 5.1 before 5.1R5 and 5.0 before 5.0R13, when Hardware Acceleration is enabled, does not properly validate the Finished TLS handshake message, which makes it easier for remote attackers to conduct man-in-the-middle attacks via a crafted Finished message.

  But they make a note that it does not affect the versions of OpenSSL shipped with RHEL 6, 7 or 8 [QUOTE]Statement Not vulnerable. This issue does not affect the version of openssl, nss and gnutls as shipped in Red Hat Enterprise Linux 5, 6 and 7.
  I'm not entirely sure I understand why any of these is coming up for your PCI scan since they're all related to specific software that isn't standard.

  0
• 

  jestep

  • June 29, 2020 13:44

  The only one that was even listed by Red Hat is:

  0
• 

  cPanelLauren

  • June 29, 2020 23:34

  I've done this myself with something else and you can edit /var/cpanel/conf/cpsrvd/main
  Then run the following: mkdir /root/ssl_socket_args-backup mv /var/cpanel/conf/cpsrvd/ssl_socket_args /root/ssl_socket_args-backup/ /scripts/restartsrv_cpsrvd
  Once you've been able to access successfully you can remove the /root/ssl_socket_args-backup
  folder

  0

Please sign in to leave a comment.