SSL Medium Strength Cipher Suites Supported (SWEET32)

[T_Lister]

Bit of a random one. Does anyone know what the below is, what it is referencing and how to fix it? It came out from a cyber security check we had done, yet that's all the information they give us.

 

The remote hosts support the use of

SSL cipher suites which comes with

multiple benefits but in old versions

there have been multiple vulnerability

found and SSL Medium Strength aka

SWEET 32 is one of them.

 

https://support.microfocus.com/kb/doc.php?id=7024780

 

The machines the scan identified, we cannot find anything to do with 'verastream' on them.

[3s-gtech]

I think Verastream is just an example of an affected product. This should give you more idea:

 

https://learn.microsoft.com/en-us/answers/questions/486172/birthday-attacks-against-tls-ciphers-with-64bit-(s

[free780]

Its a default in Windows Server (not sure about client) even though the vuln is from 2016.

 

This is how to fix in Powershell. If you have MECM you can autoamte a Compliance Baseline

 

 

 

# Triple DES 168
Start-Process reg -Wait -ArgumentList "add `"HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\Triple DES 168`"  /v Enabled /t REG_DWORD /d 0 /f"
#DES 56/56
Start-Process reg -Wait -ArgumentList "add `"HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\DES 56/56`"  /v Enabled /t REG_DWORD /d 0 /f"
#NULL
Start-Process reg -Wait -ArgumentList "add `"HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\NULL`"  /v Enabled /t REG_DWORD /d 0 /f"

Edited October 25, 2024 by free780

[pete]

This vulnerabilty? https://nvd.nist.gov/vuln/detail/CVE-2016-2183

 

I'm not sure why Microfocus are linking it to Verastream products if you're not running any - it's a general vulnerability.

 

It sounds like you have a host that will still use DES/3DES to communicate if asked. Resolve that.

 

The easiest way is via the free IIS Crypto tool from Nartac (https://www.nartac.com/products/iiscrypto/). Take advantage of the "backup settings" option before you make any changes.

 

You'll likely have to manually tell .Net to use strong crypto as well. This: https://learn.microsoft.com/en-us/mem/configmgr/core/plan-design/security/enable-tls-1-2-client is a decent starting point.

 

Be aware you can break terrible applications that still use TLS 1.0/1.1, so have a backup and test your changes before rolling them out in bulk.