How to fix SSL Medium Strength Cipher Suites Supported (SWEET32) Vulnerability...
How does it happen..?
The SSL Medium Strength Cipher Suites Supported vulnerability is a security risk that can occur when a server supports the use of medium-strength encryption ciphers. These ciphers are considered to be less secure than stronger ciphers, and they can be more easily broken by attackers.One example of a medium-strength cipher is RC4, which was first developed in the 1980s. RC4 is a Symmetric cipher, which means that the same key is used to encrypt and decrypt data. RC4 is relatively fast, but it is also relatively weak. In 2013, researchers discovered a new attack against RC4 that could be used to break the cipher in a matter of hours.
If a server supports the use of medium-strength ciphers, then an attacker could potentially exploit this vulnerability to break the encryption and gain access to sensitive data. This could include passwords, credit card numbers, or other personal information.
Mitigation...
We will offer two approaches to address this vulnerability, and you can select the method that aligns with your specific environmentIf you employ a self-managed hosting solution with a Linux server, Method 1 is applicable. similarly, if you utilize hosting services provided by a service provider, Method 2 is suitable.
Method 1: On the Server side
- Locate your server config file
The location of the server config file depends on the web server software you are using.
Here are some examples of where you can find the server config file for some popular server software.
Nginx: /etc/nginx/nginx.conf
- Identify strong ciphers
# generated 2023-08-22, Mozilla Guideline v5.7, Apache 2.4.41, OpenSSL 1.1.1k, intermediate configuration
# https://ssl-config.mozilla.org/#server=apache&version=2.4.41&config=intermediate&openssl=1.1.1k&guideline=5.7
# this configuration requires mod_ssl, mod_socache_shmcb, mod_rewrite, and mod_headers
<VirtualHost *:80>
RewriteEngine On
RewriteCond %{REQUEST_URI} !^/\.well\-known/acme\-challenge/
RewriteRule ^(.*)$ https://%{HTTP_HOST}$1 [R=301,L]
</VirtualHost>
<VirtualHost *:443>
SSLEngine on
# curl https://ssl-config.mozilla.org/ffdhe2048.txt >> /path/to/signed_cert_and_intermediate_certs_and_dhparams
SSLCertificateFile /path/to/signed_cert_and_intermediate_certs_and_dhparams
SSLCertificateKeyFile /path/to/private_key
# enable HTTP/2, if available
Protocols h2 http/1.1
# HTTP Strict Transport Security (mod_headers is required) (63072000 seconds)
Header always set Strict-Transport-Security "max-age=63072000"
</VirtualHost>
# intermediate configuration
SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305
SSLHonorCipherOrder off
SSLSessionTickets off
SSLUseStapling On
SSLStaplingCache "shmcb:logs/ssl_stapling(32768)"
Do not replace your existing web server configuration file with the sample file produced by Mozilla. Retrieve the necessary information from the sample file and use it appropriately.
Method 2: from cPanel and WHM
Replace TLS/SSL Cipher List with recommended and strong ciphers and then save the changes.
(If you have a list of medium-strength ciphers, you can exclude them from this list. There's no need to replace the default ciphers)
REFERENCES
[1] https://www.tenable.com/plugins/nessus/42873
[2] https://www.papercut.com/kb/Main/SSLCipherConfiguration/
[3] https://docs.cpanel.net/knowledge-base/security/how-to-update-ciphers-and-tls-protocols/
[4] https://ssl-config.mozilla.org/
0 Comments