分類：SSL 3.0 問題解決

About Symantec Endpoint Protection and the Poodle SSL 3.0 vulnerability (CVE-2014-3566)

Problem

 

A security bug affecting SSL 3.0 was released on October 14, 2014.

 

Solution

 

The management console for Symantec Endpoint Protection Manager (SEPM) prior to SEP 12.1.6 does use SSL 3.0. As a result, Symantec Endpoint Protection (SEP) is affected.

 

Impacted versions

  • 12.1.x Symantec Endpoint Protection Windows client
  • 12.1.5 and earlier Symantec Endpoint Protection Manager
  • 12.1 Symantec Network Access Control Windows client
  • 12.1.x Symantec Network Access Control Windows On-Demand client
  • 12.1.x Symantec Network Access Control Mac On-Demand client
  • 12.1.x Symantec Network Access Control Gateway Enforcer
  • 12.1.x Symantec Network Access Control LAN Enforcer
  • 12.1.x Symantec Network Access Control Integrated Enforcer
  • 12.1.x RU5 Security Virtual Appliance (SVA)
  • 12.1.x Symantec Endpoint Protection for Mac
  • 12.1.5 Symantec Endpoint Protection Linux client
  • 12.1.x Symantec Antivirus for Linux
  • LiveUpdate Administrator 2.3.3 and 2.3.4

 

Mitigation: Secure the communication between SEPM Java console and SEPM

Note: Due to the version of Java that shipped with SEP 12.1 RTM, 12.1 RU1 and 12.1 RU1 MP1, there are some limitations to the functionality should these steps be followed.

  1. In a text editor, open the following file:
    C:\Program Files\Symantec\Symantec Endpoint Protection Manager\apache\conf\ssl\ssl.conf
  2. Change the following line:
    SSLProtocol all -SSLv2
    to:
    SSLProtocol all -SSLv2 -SSLv3
    If the line does not exist, create it.
  3. Restart the Symantec Endpoint Protection Manager Webserver service.
  4. In a text editor, open the following file:
    C:\Program Files\Symantec\Symantec Endpoint Protection Manager\tomcat\conf\server.xml
  5. In the <Connector> section for port 8443, locate the following line:
    sslProtocol="TLS"
    Note: 8443 is the default port used for SEPM console / SEPM server communication. If you have changed the configuration, this port may be different.
  6. Do one of the following:
    • If you are using SEP 12.1 RTM, RU1, or RU1 MP1, add the following line after sslProtocol="TLS":
      Protocols="TLSv1,TLSv1.1,TLSv1.2″
    • If you are using a version of SEP later than RU1 MP1, add the following line after sslProtocol="TLS":
      sslEnabledProtocols="TLSv1,TLSv1.1,TLSv1.2″
  7. Restart the Symantec Endpoint Protection Manager service.
  8. If you use the Web console, ensure that the browser has TLS enabled.

Additional information for 12.1 RTM, RU1 and RU1 MP1

  • The web console will fail to connect. This is a known issue with that version of JRE. The only workaround is to update to a newer version of SEP.
  • The local Java console will fail to connect. To work around this problem:
    1. Install the latest JRE.
    2. Edit the file C:\Program Files\Symantec\Symantec Endpoint Protection Manager\bin\sesm.bat to replace the path of javaw.exe with the new JRE path.
  • The Remote Java console (including running locally) is not impacted.
  • If at any time you upgrade SEPM to a 12.1 version that is older than RU5, follow the steps in this document again.

 

Mitigation: Secure the communication between SEP client and SEPM

This section is only applicable if SSL has been enabled on SEPM for client communication.

Configure SEPM to accept only TLS connections

 

  1. In a text editor, open the following file:
    C:\Program Files\Symantec\Symantec Endpoint Protection Manager\apache\conf\httpd.conf
  2. Remove the “#” character at the beginning of the following line:
    #Include conf/ssl/sslForClients.conf
  3. In a text editor, open the following file:
    C:\Program Files\Symantec\Symantec Endpoint Protection Manager\apache\conf\ssl\sslForClients.conf
  4. Change the following line:
    SSLProtocol all -SSLv2
    to:
    SSLProtocol all -SSLv2 -SSLv3
  5. Restart the Symantec Endpoint Protection Manager Webserver service.

If at any time you upgrade SEPM to a 12.1 version that is older than RU5, follow the steps in this document again.

 

Enable TLS on communication between SEP client and SEPM

On Windows XP or 2003 clients that use Internet Explorer (IE) 6.x, enable TLS manually. All other operating systems have TLS enabled by default.

Note: This is an operating system change. Please consult Microsoft documentation should there be any questions. Also, ensure that any applicable testing is conducted to ensure no negative results with third party applications.

Enable all SSL versions and TLS1.0 for the local system account

  1. In the Windows registry, go to the following key:
    HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings
  2. Change the DWORD value SecureProtocols to 0xa8.
  3. Restart the SEP service.

 

Mitigation: Secure the communication between Symantec Network Access Control Windows On-Demand Client and SEPM

 

The following changes should be made to enable TLS before using Symantec Network Access Control (SNAC) Windows On-Demand Client (WODC) on Windows XP or 2003 clients that use IE 6.x.

Note: This is an operating system change. Please consult Microsoft documentation should there be any questions. Also, ensure that any applicable testing is conducted to ensure no negative results with third party applications.

  1. On the client computer, log on to Windows as the user that will run WODC.
  2. In the Windows registry on the client computer, do one of the following:
    • If the user account that runs WODC is part of the local administrators group, go to HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings, and set the SecureProtocols value to 0xa8.
    • If the user account that runs WODC is not part of the local administrators group, go toHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings, and set the SecureProtocols value to 0xa8.

 

Mitigation: Secure the communication between SEPM Remote Management Application (RMM) and SEP clients

 

If you do not use the RMM feature, you can disable the RMM port.

Note: Once SSL 3.0 is disabled for RMM web service ports, any client that uses this service will have to use TLS to connect. If the client does not support TLS, the connection to RMM web service will fail.

  1. In a text editor, open the following file:
    C:\Program Files\Symantec\Symantec Endpoint Protection Manager\tomcat\conf\server.xml
  2. In the <Connector> section for port 8446, after the line sslProtocol="TLS", add the following line:
    sslEnabledProtocols="TLSv1,TLSv1.1,TLSv1.2″
    Note: 8446 is the default port used for SEPM RMM communication. If you have configured the port, this value might be different Check your configuration settings to see the actual value.
  3. Restart the Symantec Endpoint Protection Manager service.

If at any time you upgrade SEPM to a 12.1 version that is older than RU5, follow the steps in this document again.

 

Mitigation: Disable web services for Symantec Protection Center (SPC)

 

Disable web services for SPC. SEPM port 8444 is used for SPC communication. This port has hard-coded support for SSLv3.

Disabling web services may impact the function of SPC.

 

Mitigation: Secure LiveUpdate Administrator communications

 

If LiveUpdate Administrator is installed, disable SSL communications.

Disable SSL

  1. In the LiveUpdate Administrator installation folder, go to \tomcat\conf\.
  2. Open server.xml in a text editor.
  3. Find the line that begins with:
    <Connector port="7073″ maxHttpHeaderSize="8192″ clientAuth="false" SSLEnabled="true" keystoreFile="../jre/bin/server-cert.ssl" …
  4. Change
    sslProtocol="TLS"
    to
    sslEnabledProtocols = “TLSv1,TLSv1.1,TLSv1.2″
  5. Save and close server.xml.
  6. Restart the Tomcat services.

 

Poodle variant CVE 2014-8730

 

Symantec Endpoint Protection is not affected by the Poodle variant CVE 2014-8730.

 

References

 

https://support.symantec.com/en_US/article.TECH225689.html

About Data Center Security: Server (Advanced) and the Poodle SSL 3.0 vulnerability (CVE-2014-3566)

Problem

 

A security bug affecting SSL 3.0 was released on October 14, 2014.

 

Solution

 

The DCS 6.0.x and CSP 5.2.9 Manager utilize a version of SSL 3.0 that is susceptible to POODLE. Customers should add the entry sslEnabledProtocols="TLSv1,TLSv1.1,TLSv1.2″ to <server install>\tomcat\conf\server.xml. All future release will contain this change by default.

Recommend steps:

  1. Stop CSP/DCS manager service
  2. Take backup of Server.xml file
  3. Edit the server.xml file to make the suggested changes using xml editors to ensure that double quotes (“) with appropriate encoding will be used.
  4. Start CSP/DCS manager service

 

CSP Server 5.2.9 MP1 – MP5 (having Tomcat 7.x)

DCS:SA Server 6.0, 6.0 MP1 (having Tomcat 7.x)

The entry sslEnabledProtocols="TLSv1,TLSv1.1,TLSv1.2″ needs to be added to the three SSL Connector configured in server.xml.

 

These SSL Connectors are for the:

  • Tomcat Stand-Alone Agent Service
  • Tomcat Stand-Alone Console Service
  • Tomcat Stand-Alone Service

 

The following example shows this change:

<Connector port="%AGENT_PORT% / %CONSOLE_PORT% / %ADMIN_PORT%"

maxThreads="200″ minSpareThreads="50″ enableLookups="false" disableUploadTimeout="true" maxKeepAliveRequests="1″

acceptCount="25″ scheme="https" secure="true" SSLEnabled="true"

keystorePass="<KeyStorePassword>"

keystoreFile="<KeyStoreFilePath>"

clientAuth="false" sslProtocol="TLS" sslEnabledProtocols="TLSv1,TLSv1.1,TLSv1.2″

ciphers="%comma_separated_list_of_ciphers%"/>

 

<Connector port="%AGENT_PORT% / %CONSOLE_PORT% / %ADMIN_PORT%"

maxThreads="40″ minSpareThreads="10″ enableLookups="false"

disableUploadTimeout="true" maxKeepAliveRequests="1″

acceptCount="10″ scheme="https" secure="true" SSLEnabled="true"

keystorePass="<KeyStorePassword>"

keystoreFile="<KeyStoreFilePath>"

clientAuth="false" sslProtocol="TLS" sslEnabledProtocols="TLSv1,TLSv1.1,TLSv1.2″

ciphers="%comma_separated_list_of_ciphers%"/>

 

CSP Server 5.2.8 – 5.2.8 MP4 and 5.2.9 (having tomcat 5.x):

The entry sslProtocols="TLSv1,TLSv1.1,TLSv1.2″ needs to be added to the following SSL Connector configured in server.xml.

  • Tomcat Stand-Alone Service

 

The entry sslProtocols="SSLv2Hello,TLSv1,TLSv1.1,TLSv1.2″ needs to be added to the following SSL Connector configured in server.xml.

  • Tomcat Stand-Alone Console Service
  • Tomcat Stand-Alone Agent Service

 

The following example shows this change:

<Connector port="%AGENT_PORT% / %CONSOLE_PORT% / %ADMIN_PORT%"

maxThreads="200″ minSpareThreads="50″ maxSpareThreads="100″

enableLookups="false" disableUploadTimeout="true" maxKeepAliveRequests="1″

acceptCount="25″ debug="0″ scheme="https" secure="true"

keystorePass="<KeyStorePassword>"

keystoreFile="<KeyStoreFilePath>"

clientAuth="false" sslProtocol="TLS" sslProtocols="SSLv2Hello,TLSv1,TLSv1.1,TLSv1.2″

ciphers="%comma_separated_list_of_ciphers%"/>

 

<Connector port="%AGENT_PORT% / %CONSOLE_PORT% / %ADMIN_PORT%"

maxThreads="40″ minSpareThreads="10″ maxSpareThreads="25″

enableLookups="false" disableUploadTimeout="true" maxKeepAliveRequests="1″

acceptCount="10″ debug="0″ scheme="https" secure="true"

keystorePass="<KeyStorePassword>"

keystoreFile="<KeyStoreFilePath>"

clientAuth="false" sslProtocol="TLS" sslProtocols="SSLv2Hello,TLSv1,TLSv1.1,TLSv1.2″

ciphers="%comma_separated_list_of_ciphers%"/>

 

<Connector port="%AGENT_PORT% / %CONSOLE_PORT% / %ADMIN_PORT%"

maxThreads="55″ minSpareThreads="5″ maxSpareThreads="8″

enableLookups="false" acceptCount="10″ maxKeepAliveRequests="1″ debug="0″

connectionTimeout="20000″ scheme="https" disableUploadTimeout="true" secure="true"

keystorePass="<KeyStorePassword>"

keystoreFile="<KeyStoreFilePath>"

clientAuth="false" sslProtocol="TLS" sslProtocols="TLSv1,TLSv1.1,TLSv1.2″

ciphers="%comma_separated_list_of_ciphers%"/>

—

This issue has been addressed in SCSP 5.2.9 MP6

Symantec Critical System Protection 5.2 RU9 MP6 uses only the TLSv1x protocol to communicate among the server, agent, and console.

—

References

 

https://support.symantec.com/en_US/article.TECH225827.html

Symantec DLP and POODLE SSL 3.0 protocol weakness (CVE-2014-3566)

Problem

 

Symantec Data Loss Prevention uses the SSL/TLS protocol to secure netwok communications. SSL/TLS channels are used between the client browser and the Enforce Server, the Enforce Server and detection servers, as well as between the Endpoint Server and DLP Agents. The SSL/TLS channel between the client browser and the Enforce Server administration console may use SSL 3.0.

SSL 3.0 uses nondeterministic CBC padding in certain ciphers, which makes it easier for man-in-the-middle attackers to obtain clear-text data via a padding-oracle attack (dubbed POODLE – Padding Oracle On Downgraded Legacy Encryption).

Solution

 

SSL/TLS Channel

Protocol

Impact

Comments
Web browser <–> Enforce Server administration console SSL 3.0, TLS 1.0, TLS 1.1, TLS 1.2 Affected (not vulnerable)

Action required.

Depending on the Data Loss Prevention version, SSL 3.0 support can be disabled in the web browser, or by updating the tomcat configuration. Updating tomcat’s configuration is the recommended and long-term approach, as this will ensure SSL 3.0 is never negotiated with the browser.

Data Loss Prevention 11.6.x and 12.x
SSL 3.0 can be disabled either by updating the tomcat server configuration, or in the web browser.

To disable SSL 3.0 support via the tomcat server configuration files:

  1. In server.xml (typically inC:\SymantecDLP\Protect\tomcat\conf\ on Windows), addsslEnabledProtocols="TLSv1.2,TLSv1.1,TLSv1″ to the HTTPS Connector configuration (<Connector …).
  2. Restart the Vontu Manager service.

To disable SSL 3.0 support in the web browser, follow the steps outlined below for Data Loss Prevention version 11.5.x and earlier.

Data Loss Prevention 11.5.x and earlier

SSL 3.0 support must be disabled in the web browser.

In Firefox:

  1. Type about:config in the URL bar.
  2. Set security.tls.version.min to 1, andsecurity.tls.version.max to 3. Refer to this link for details.

In Internet Explorer:

  1. Go to Settings/Tools > Internet Options > Advanced tab.
  2. Uncheck “Use SSL 3.0″.
  3. Click Apply.
  4. Click Okay.
Enforce Server <–> detection servers TLS 1.0, TLS 1.1, TLS 1.2 Not Affected

No action required.

Enforce and Detection servers use TLS protocol by default for communication.
Endpoint Server <–> DLP Agents TLS 1.0, TLS 1.1, TLS 1.2 Not Affected

No action required.

Endpoint Server and DLP Agents use TLS by default for communication.

 

References

https://support.symantec.com/en_US/article.TECH225739.html