SIMS Exams Organiser and TLS 1.0

[smarties11]

Hi All,

 

We've had an issue recently whereby on a new RemoteApp deployment, SIMS Exams Organiser refuses to work, giving various SQL errors and requesting credentials. CAPITA investigated this for us, and found errors in the server event log relating to schannel. On seeing these, it dawned on me what the issue was - as this server is public facing, I use IIS Crypto to disable insecure protocols and ciphers. Therefore I figured Exams Organiser must be communicating with SQL using one of these. After some testing by enabling / disabling various protocols, I have narrowed it down to TLS 1.0. If you disable this protocol on an Exams Organiser client, it can then no longer speak to the SIMS SQL database.

 

CAPITA are escalating this, however it is a little concerning given that TLS 1.0 has been insecure for several years. Obviously within a LAN the implications of this are not as great as they would be with a public facing service - but it did surprise me I must admit.

 

I thought I should make other Schools aware that may be using this across RemoteApp or any other public facing system - if you are using it successfully, then that means you have TLS 1.0 enabled which is a security risk.

[Steve21]

I may be missing the obvious, (ignoring the general old TLS issue), but how would disabling TLS on the gateway affect SIMs on a RDS host? Or do you have the apps installed on the same VM as the gateway rather than separate roles?

 

Steve

[smarties11]

Yes, it's a very small deployment used by about 10 users, so all the RDS/RemoteApp roles are on the same VM. We could split them I suppose but would be a waste of resource. The real issue here Exam Organisers use of a now insecure protocol to talk to the SQL backend. Edited January 13, 2021 by smarties11

[free780]

You may just be able to allow TLS 1.0 on the client side of Schannel (as a temp fix) on the remote app server. The App needs updating to use TLS 1.2 and SQL may need updates depending on which version.

[psydii]

https://docs.microsoft.com/en-us/security/engineering/solving-tls1-problem

 

TLS 1.0 is a security protocol first defined in 1999 for establishing encryption channels over computer networks. Microsoft has supported this protocol since Windows XP/Server 2003. While no longer the default security protocol in use by modern OSes, TLS 1.0 is still supported for backwards compatibility. Evolving regulatory requirements as well as new security vulnerabilities in TLS 1.0 provide corporations with the incentive to disable TLS 1.0 entirely.

 

Microsoft recommends customers get ahead of this issue by removing TLS 1.0 dependencies in their environments and disabling TLS 1.0 at the operating system level where possible.

[smarties11]

Makes me wonder when it would have been picked up by CAPITA otherwise. I don't think it will be too long before MS disable TLS 1.0 in the OS by default, they've already disabled it in their browsers. Would we have just installed the latest feature pack or a windows update one day to find Exams Organiser broken on all of our clients?!

[smarties11]

You may just be able to allow TLS 1.0 on the client side of Schannel (as a temp fix) on the remote app server. The App needs updating to use TLS 1.2 and SQL may need updates depending on which version.

 

SQL has fully supported TLS 1.2 since early 2016 so I would hope most people have run a service pack / CU since then! It's the app rewrite that is the issue as I suspect it won't be quick.

[smarties11]

Just to add back to this thread that CAPITA have committed to fixing this issue in the Summer 2021 release. Updates are in KB0044887 on the support portal.