asked on

Vulnerability, security, SSL/TLS, Active directory,

Our security team ran an external VM scan on DMZ and had some vulnerabilities.

i have 1 question:

SSL/TLS server supports TLSv1.0 vulnerability ( 38628) does not provide much info for windows server 2008 (R2) servers.
we looked at this article . https://blog.qualys.com/ssllabs/2014/12/08/poodle-bites-tls

we are not sure if this is a legitimate vulnerability or false positive.

solution is to opnessl but we do not have it installed.

could you please let me know with some more information to see if this protocol (TLSv1.0) needs to be disabled or we can disregard.

there is 1 article i searched - https://blogs.msdn.microsoft.com/friis/2016/0725/disabling-tls-1-0-on-your-windows-2008-r2-server-just-because-you-still-have-one

above links list instructions to disable 1.0 and enable 1.1 and 1.2

i need to compile the list , can you provide any thoughts of the top link above, how should i make changes ??

Dr. Klahn

In 2014 it was shown that SSL V3, TLS V1.0 and TLS V1.1 are subject to "POODLE" attacks. None of these should be considered secure (not even after installing the recommended patches) and none should be used in environments where security is important.

https://blog.varonis.com/ssl-and-tls-1-0-no-longer-acceptable-for-pci-compliance/

https://www.globalsign.com/en/blog/poodle-vulnerability-expands-beyond-sslv3-to-tls/

kevinhsieh

TLS 1.0 has protocol design flaws that make it vulnerable. All sites that require PCI compliance should have it disabled already. TLS 1.2 is the current standard, with TLS 1.3 recently ratified (though it will not be available for Windows 2008 R2. Most things that support TLS 1.2 also support TLS 1.1, so it might be possible to just go 1.2 only.

What is being secured? Lots of other software like RDP and Outlook may require updates before they run properly over TLS 1.2.

btan

Same as the expert mentioned. You can see advisory from the authority on best practice and from community. In order to ensure that only strong cryptographic ciphers are selected the server must be modified to disable the use of weak ciphers and to configure the ciphers in an adequate order.
https://www.us-cert.gov/ncas/alerts/TA15-120A
https://www.owasp.org/index.php/Transport_Layer_Protection_Cheat_Sheet#Rule_-_Only_Support_Strong_Protocols

Also TLS 1.3 has been published as of August 2018. More info below.
https://kinsta.com/blog/tls-1-3/#security-tls-1.3

For tool wise I suggest upu check out iiscrypto which help to enable the strong cipher.
https://www.nartac.com/Products/IISCrypto/

masnrock

SSL/TLS server supports TLSv1.0 vulnerability ( 38628) does not provide much info for windows server 2008 (R2) servers.
we looked at this article . https://blog.qualys.com/ssllabs/2014/12/08/poodle-bites-tls

we are not sure if this is a legitimate vulnerability or false positive.

Very real.

above links list instructions to disable 1.0 and enable 1.1 and 1.2

Disable 1.1 as well. Only keep 1.2 or higher. If you have systems that won't work with safe versions of TLS, either look at a reverse proxy or upgrading the systems.

subhashm

Before you disable TLSv1.0, make sure you identify and remove/fix all dependencies - all applications / systems that support only TLSv1.0

We had recently disabled TLS on our domain - regedit on all DC's
We had run network trace to see TLSv1.0 traffic to domain controllers, and then contact the server owner to get the TLS dependency addressed.