IZ64433: VULNERABILITY SSL SERVER ALLOWS CLEARTEXT COMMUNICATION

APAR status

• Closed as fixed if next.

Error description

• The following vulnerability has been found on Impact 4.0.2:"SSL
  
  Server Allows
  Cleartext Communication (Null Cipher Support)"
  

Local fix

• Upgrade to Impact 5.1.  And do the following:
  
  
  
  Since we do not have a console we can modify the security.xml
  manually.
  Make a backup copy and then modify this line...
  
  <setting xmi:id="SecureSocketLayer_ImpactNode_1"
  clientAuthentication="false" securityLevel="HIGH"
  enabledCiphers=""
  jsseProvider="IBMJSSE2" sslProtocol="SSL_TLS"
  keyStore="KeyStore_ImpactNode_1"
  trustStore="KeyStore_ImpactNode_2"
  trustManager="TrustManager_ImpactNode_1"
  keyManager="KeyManager_ImpactNode_1"/>
  
  Change to the following,
  
  <setting xmi:id="SecureSocketLayer_ImpactNode_1"
  clientAuthentication="false" securityLevel="CUSTOM"
  enabledCiphers="SSL_RSA_WITH_RC4_128_MD5
  SSL_RSA_WITH_RC4_128_SHA
  SSL_RSA_WITH_AES_128_CBC_SHA SSL_DHE_RSA_WITH_AES_128_CBC_SHA
  SSL_DHE_DSS_WITH_AES_128_CBC_SHA SSL_RSA_WITH_3DES_EDE_CBC_SHA
  SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
  SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
  SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA SSL_DHE_DSS_WITH_RC4_128_SHA
  SSL_RSA_WITH_DES_CBC_SHA SSL_RSA_FIPS_WITH_DES_CBC_SHA
  SSL_DHE_RSA_WITH_DES_CBC_SHA SSL_DHE_DSS_WITH_DES_CBC_SHA"
  jsseProvider="IBMJSSE2" sslProtocol="SSL_TLS"
  keyStore="KeyStore_ImpactNode_1"
  trustStore="KeyStore_ImpactNode_2"
  trustManager="TrustManager_ImpactNode_1"
  keyManager="KeyManager_ImpactNode_1"/>
  

Problem summary

• 5.1.0-TIV-NCI-FP0001 must be installed to fix this problem
  
  modify the security.xml manually.
  Make a backup copy and then modify this line...
  
  <setting xmi:id="SecureSocketLayer_ImpactNode_1"
  clientAuthentication="false" securityLevel="HIGH"
  enabledCiphers=""
  jsseProvider="IBMJSSE2" sslProtocol="SSL_TLS"
  keyStore="KeyStore_ImpactNode_1"
  trustStore="KeyStore_ImpactNode_2"
  trustManager="TrustManager_ImpactNode_1"
  keyManager="KeyManager_ImpactNode_1"/>
  
  Change to the following,
  
  <setting xmi:id="SecureSocketLayer_ImpactNode_1"
  clientAuthentication="false" securityLevel="CUSTOM"
  enabledCiphers="SSL_RSA_WITH_RC4_128_MD5
  SSL_RSA_WITH_RC4_128_SHA
  SSL_RSA_WITH_AES_128_CBC_SHA SSL_DHE_RSA_WITH_AES_128_CBC_SHA
  SSL_DHE_DSS_WITH_AES_128_CBC_SHA SSL_RSA_WITH_3DES_EDE_CBC_SHA
  SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
  SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
  SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA SSL_DHE_DSS_WITH_RC4_128_SHA
  SSL_RSA_WITH_DES_CBC_SHA SSL_RSA_FIPS_WITH_DES_CBC_SHA
  SSL_DHE_RSA_WITH_DES_CBC_SHA SSL_DHE_DSS_WITH_DES_CBC_SHA"
  jsseProvider="IBMJSSE2" sslProtocol="SSL_TLS"
  keyStore="KeyStore_ImpactNode_1"
  trustStore="KeyStore_ImpactNode_2"
  trustManager="TrustManager_ImpactNode_1"
  keyManager="KeyManager_ImpactNode_1"/>
  

Problem conclusion

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

Applicable component levels

• R510 PSY

     UP