Security Vulnerability with SSL. (FYI: Not necessarily an Alpha 5 problem.)

[lgrupido]

One of my customers must have periodic scans of the network for PCI compliance. The latest issue is this:

Multiple Vendor TLS Protocol Session Renegotiation Security Vulnerability

I am not entirely sure what that means, but searching the web seems to show that it is a vulnerability with Open SSL (and other SSL solutions.)

I have the latest SSL DLLs from the recent Heartbleed drama, and those seem to contain the problem also.

It appears that there is an "extension" that fixes this problem. But I have no idea how to apply this extension to my current Alpha 5 Solution. (I am using V11 with the V12 SSL DLLs.)

http://www.securityfocus.com/bid/36935/solution

Does anyone have experience with this that could help me?

[Steve Wood]

Re: Security Vulnerability with SSL. (FYI: Not necessarily an Alpha 5 problem.)

Larry,

Follow the download link on this page:http://msgboard.alphasoftware.com/al...363-Heartbleed

Good for your guys to run a security scan. Is it possible for you to find out how they run that scan so we all can run similar scans on our apps?

[lgrupido]

Re: Security Vulnerability with SSL. (FYI: Not necessarily an Alpha 5 problem.)

Steve,

I have those files already. (* note - they DO fix the Heartbleed issue, but not THIS issue. *)

As I said, it looks like you need to add theses as an extension from the link above in order to fix this OTHER issue.

The scans my client is using are run from.

www.controlscan.com

I assume they would do scans for anyone's app for a fee. (Client scans are included as part of a package for PCI compliance - I don't know what they cost individually.)

[Lenny Forziati]

Re: Security Vulnerability with SSL. (FYI: Not necessarily an Alpha 5 problem.)

Those DLLs that we have made available are OpenSSL 1.0.1g, which includes all of OpenSSL.org's fixes for this issue. To further secure your server, it is recommended that you disable SSL v2 and weak ciphers. This is done by default in V12 and later V12 builds. To do this in V11, specify the following string as the SSL Cipher List on the SSL tab of thr Application Server Settings dialog.

TLSv1+HIGH:!SSLv2:RC4+MEDIUM:!aNULL:!eNULL:!3DES:@STRENGTH

This Cipher List is from http://www.skytale.net/blog/archives...r-setting.html and that URL will fully explain what it means.

[lgrupido]

Re: Security Vulnerability with SSL. (FYI: Not necessarily an Alpha 5 problem.)

That cipher list was already on the server. You must have started using it with V11, because I didn't add it. (And that same list is also on another V11 server using SSL.

I am running a scan again overnight, but I still expect that one vulnerability to show up. We shall see.

[lgrupido]

Re: Security Vulnerability with SSL. (FYI: Not necessarily an Alpha 5 problem.)

Full disclosure:

We are not running the scans because we want to, they are mandated by the credit card merchant. They are a huge pain in the butt made more difficult by the apparent lack of anyone else on the forum doing the same thing!

When it comes to software testing, I much prefer being the second person instead of the first!!

Larry,

Follow the download link on this page:http://msgboard.alphasoftware.com/al...363-Heartbleed

Good for your guys to run a security scan. Is it possible for you to find out how they run that scan so we all can run similar scans on our apps?

[lgrupido]

Re: Security Vulnerability with SSL. (FYI: Not necessarily an Alpha 5 problem.)

Another vulnerability that the system is noting I thought I had fixed, but I only got a part of it. Could use a suggestion to fix this also. This is a standard contact us form. The system is saying that if you send the page some code, it returns the code, possibly allowing malicious software to be run.

web program allows cross-site scripting in query string (contact.a5w)

Service: https
Sent:
GET contact.a5w?%3E%3CSCRIPT%3Ealert('SAINT')%3C/SCRIPT%3E HTTP/1.0
User-Agent: Mozilla/4.0
Connection: Keep-alive
Cookie: A5WSessionId=66450ee3206a4965a98ad9247d95598c


Received:
CONTACT_GridObj._QS='><SCRIPT>alert(\'SAINT\')</SCRIPT>';

[Steve Wood]

Re: Security Vulnerability with SSL. (FYI: Not necessarily an Alpha 5 problem.)

I confirmed that you will get this "problem" on ANY page that has ANY grid on it. In your app, the only public page that has a grid on it is the contact page.

[Steve Wood]

Re: Security Vulnerability with SSL. (FYI: Not necessarily an Alpha 5 problem.)

Larry, if this problem *must* be solved, then the solution is for me (or you) to rewrite the Contact component as a Dialog2/UX rather than a Grid. This particular contact form could be either. In fact, the only reason it is a Grid is because the component was written prior to V11 and the Dialog was not up to par at that time.

[lgrupido]

Re: Security Vulnerability with SSL. (FYI: Not necessarily an Alpha 5 problem.)

So the dialogue does not present the same problem?

That is very interesting.

I don't have enough experience with Dialogues, and I DO need this fixed. I'll re-write the component myself - and will let you know if I need any help.

Thank you for testing this out!

Larry

[Lenny Forziati]

Re: Security Vulnerability with SSL. (FYI: Not necessarily an Alpha 5 problem.)

Larry, SAINT is a pretty common vulnerability scanner and you are not the first of our customers to have it used against one of their sites.

On the TLS issue, the vulnerability report should include a suggested fix for Apache servers. What exactly does it say to do there?

For the XSS issue, this is a false positive presented by the scanner because it oversimplifies the test. It injects a string of "exploit" Javascript in the query string, then looks to see if that string is included in the resulting response. This is too simple of a test though because while that string is in fact included as part of the response, it is NOT executable and no exploit is run. You can confirm this quite simply by requesting the exact same URL. If there were an exploit, you would see a Javascript alert window displaying SAINT, but no such alert window will be opened.

[lgrupido]

Re: Security Vulnerability with SSL. (FYI: Not necessarily an Alpha 5 problem.)

Lenny,

For the XSS issue, Steve Wood has confirmed that Dialogues do not have this problem, only grids. Since it's only 1 page with a grid, I am working on converting that to a dialogue instead. Once we do that, the issue should go away.

As for the TLS issues, the vendor report is below. (it does not provide a suggested solution.)

I have not called their tech support yet to see what they suggest - I'm working on the openly fixable problem first to show the client that I am making progress.

THREAT REFERENCE

Summary:
TLS Protocol Session Renegotiation Security Vulnerability

Risk: High (3)
Port: 443/tcp
Protocol: tcp
Threat ID: misc_opensslrenegotiation

Details: Multiple Vendor TLS Protocol Session Renegotiation Security Vulnerability
06/11/12
CVE 2009-3555
Multiple vendors TLS protocol implementations are prone to a security vulnerability related to the session-renegotiation process which allows man-in-the-middle attackers to insert data into HTTPS sessions,
and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context.

Information From Target:
Service: 443:TCP
Session Renegotiation succeeded on 443:TCP and secure renegotiation did not succeed

[lgrupido]

Re: Security Vulnerability with SSL. (FYI: Not necessarily an Alpha 5 problem.)

BTW:

Thank you for your response to this, I wasn't ignoring it with my last response. If I didn't have a possible solution that would fix the problem (using a dialogue instead) it would be helpful in arguing with the scanning vendor. However, since they scan every 3 months, I don't want to have that argument if I can avoid it!

Larry, SAINT is a pretty common vulnerability scanner and you are not the first of our customers to have it used against one of their sites.

For the XSS issue, this is a false positive presented by the scanner because it oversimplifies the test. It injects a string of "exploit" Javascript in the query string, then looks to see if that string is included in the resulting response. This is too simple of a test though because while that string is in fact included as part of the response, it is NOT executable and no exploit is run. You can confirm this quite simply by requesting the exact same URL. If there were an exploit, you would see a Javascript alert window displaying SAINT, but no such alert window will be opened.

[Lenny Forziati]

Re: Security Vulnerability with SSL. (FYI: Not necessarily an Alpha 5 problem.)

Can you confirm how you updated V11 to use the V12 OpenSSL DLLs? It sounds like it is still using an older version of OpenSSL.

[lgrupido]

Re: Security Vulnerability with SSL. (FYI: Not necessarily an Alpha 5 problem.)

I tested the server with the vulnerability tester you recommended. The server failed.

I downloaded V12 (developer version) and installed it locally.

I found the two DLL files and copied them over the files of the same name in the program directory of the server. (I had to down the server first.)

I rebooted the system for good measure.

Then I ran the heartbleed vulnerability tester and it passed.

I have recently double checked the files I am using against the ones you recently posted. They are the same files.