Security Vulnerability with SSL. (FYI: Not necessarily an Alpha 5 problem.)

[lgrupido]

Re: Security Vulnerability with SSL. (FYI: Not necessarily an Alpha 5 problem.)

Update: I replaced the grid component with a dialogue component. The scan passed the XSS issue just fine.

But I still have to fix the TLS issue.

Lenny, are you saying that if I switch to V12, this issue will be resolved?

[Lenny Forziati]

Re: Security Vulnerability with SSL. (FYI: Not necessarily an Alpha 5 problem.)

I'm saying it should be resolved in V11 as well as V12. It sounds like you are not running the 1.0.1g DLLs even though you think you are. You should search your entire system for any and all copies of these DLLs and make sure there are no older versions around.

[lgrupido]

Re: Security Vulnerability with SSL. (FYI: Not necessarily an Alpha 5 problem.)

I did a search on the C drive for ssleay32.dll.

I did find it in several other locations. I'm not sure what the ramifications for replacing it in all those locations will be so I'll have to try them one at a time.

Probably the one that is most problematic:

I have the correct file in program files (x86) for alpha server 1 and 2 (I am running the server twice - once for port 80 and once for 443).

But under just program files, I have the right dll in server 1, but not in server 2. (And server 2 is the secure one.)

Don't know how I missed that, but thank you Lenny.

The other ones I am concerned about:

c:\windows\syswow64\MPK
c:\program files (x86)\premiumsoft\navicat for MySQL
Also File Zilla and An Intel client.

I can't fix it right now because the server is in use. But I will try again until it's fixed or until I run out of dlls to replace. I will let you know one way or the other when my testing is done.

Thanks again,

Larry

[Lenny Forziati]

Re: Security Vulnerability with SSL. (FYI: Not necessarily an Alpha 5 problem.)

The Application Server should not have files in both program files and program files(x86). I'm not sure how you ended up with them in both locations, but I suggest you verify which you are actually using and remove the extra to eliminate confusion such as this.

-Lenny

[lgrupido]

Re: Security Vulnerability with SSL. (FYI: Not necessarily an Alpha 5 problem.)

Will do!

[lgrupido]

Re: Security Vulnerability with SSL. (FYI: Not necessarily an Alpha 5 problem.)

Still not passing the scan.

I have replaced the two dlls in all locations on the server, and I have removed the extra Alpha 5 installations. I even uninstalled an application that was using the one set of the dlls.

I double checked the entire drive by searching for the dll names.

And the scan still failed with the same vulnerability.

I double checked for vulnerability on my own at http://www.digicert.com/help/

That says that the server passed the heartbleed vulnerability. How can it pass Heartbleed if it's not using the latest dlls?

[Lenny Forziati]

Re: Security Vulnerability with SSL. (FYI: Not necessarily an Alpha 5 problem.)

That says that the server passed the heartbleed vulnerability. How can it pass Heartbleed if it's not using the latest dlls?

The OpenSSL 0.9.8 branch is NOT vulnerable to the Heartbleed bug. But it IS vulnerable to TLS renegotiation. I can't say definitively that you are using this branch, but it would at least explain your observations.

Create an A5W page with the following code and execute it to see which DLLs are loaded by your server

<%a5
dim vers as Util::ExecutableVersion

if vers.Load("ssleay32.dll")
	Response.Write("ssleay32.dll version: " + vers.Entry[1].ProductVersion)
else
	Response.Write("Could not load ssleay32.dll")
end if

Response.Write("<br />")

if vers.Load("libeay32.dll")
	Response.Write("libeay32.dll version: " + vers.Entry[1].ProductVersion)
else
	Response.Write("Could not load libeay32.dll")
end if
%>

[lgrupido]

Re: Security Vulnerability with SSL. (FYI: Not necessarily an Alpha 5 problem.)

I ran that script and this is what I get:

ssleay32.dll version: 1.0.1g
libeay32.dll version: 1.0.1g

Note: The script is missing "then" for each of the if statements, in case anyone else tries it on their system.

[lgrupido]

Re: Security Vulnerability with SSL. (FYI: Not necessarily an Alpha 5 problem.)

Just to be clear:

This is a windows 2008 server with only the server installed and nothing else except what is required for Alpha.

The server has nothing on it except Alpha, MySQL and FileZilla.

It has NO roles. It is not running IIS, Microsoft FTP or anything else. It is not even a domain controller. It is the only computer on it's own private network.

The problem is occurring on port 443. The only thing answering on that port is Alpha5. The server can ONLY be accessed by the general public from port 80 and 443.

Everything else is closed off by the firewall. I have two specific IP addresses (My home and my work) that can remote connect in - everything else is all bottled up.

In case it matters the version of Alpha 5 running on that server is:

V11 build 3044
Addins 4041

[Lenny Forziati]

Re: Security Vulnerability with SSL. (FYI: Not necessarily an Alpha 5 problem.)

I ran that script and this is what I get:

ssleay32.dll version: 1.0.1g
libeay32.dll version: 1.0.1g

Note: The script is missing "then" for each of the if statements, in case anyone else tries it on their system.

then is optional in Xbasic. The code executes successfully as-is.


It is fairly simple to test for this vulnerability if you have all of OpenSSL: http://devadraco.blogspot.com/2010/0...gotiation.html. You likely do not have it though, so if you email or PM me with the server's IP address, I can test remotely for you.

[lgrupido]

Re: Security Vulnerability with SSL. (FYI: Not necessarily an Alpha 5 problem.)

Thank you Lenny,

I sent you the site info via private message.

[Lenny Forziati]

Re: Security Vulnerability with SSL. (FYI: Not necessarily an Alpha 5 problem.)

Larry, the manual test process from the link I posted before as well as the online tests at https://www.ssllabs.com/ssltest/ and http://netsekure.org/2009/11/tls-renegotiation-test/ all confirm that your server is NOT vulnerable. It does support secure renegotiation, but does not have the CVE-2009-3555 vulnerability.

[lgrupido]

Re: Security Vulnerability with SSL. (FYI: Not necessarily an Alpha 5 problem.)

Thank you for verifying this for me.

I will call the scanning vendor and see if they will accept that, or if they can tell me what I have to do to make them happy.

Larry

[lgrupido]

Re: Security Vulnerability with SSL. (FYI: Not necessarily an Alpha 5 problem.)

Woo Hoo!

I called the scanning vendor and they concur with your results. Unfortunately, they do quarterly scans and this "issue" will show up every time on the automatic scans, so I will have to call them just about every scan to have them manually verify, but I can live with that.

Thank you.