Snapshot 12204
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Subject: DROWN vulnerability (CVE-2016-0800) – Updated March 6, 2016 Overview Ex Libris has been made aware of a recently discovered vulnerability known as DROWN (Decrypting RSA with Obsolete and Weakened Encryption) that affects HTTPS and other services that rely on SSL/TLS implementations and is rated as “High”. An unauthorized user can execute this vulnerability to read or steal information sent via the ‘secure connection’ by decrypting the SSL session.The attack will succeed as long as the targeted system supports the SSLv2, even if the system is not running SSLv2. This flaw is in the SSLv2 protocol, and affects all implementations. A server is vulnerable to a DROWN attack if either of the following two conditions are met: It supports SSLv2 requests Its private key is used on any other server that allows SSLv2 connections, even for newer SSL/TLS Protocol versions Detailed information about this vulnerability can be found in the Red Hat advisory CVE-2016-0800 where more information is available. Additional references More detailed analysis of this vulnerability is available from: https://access.redhat.com/articles/2176731 https://drownattack.com/ https://www.us-cert.gov/ncas/current...2-DROWN-Attack Effective Security Severity Level: High Affected Systems: Ex Libris products using SSL traffic (HTTPS) where SSLv2 is still enabled. Tests and Certifications: The mitigation for this vulnerability has been identified and tested and certified for Ex Libris products. Actions Taken for Hosted Systems: Ex Libris cloud is protected from this vulnerability. Required Actions for On-Premises and Local Systems: Ex Libris strongly recommends the following: Apply the latest 3rd party update using Util SP command as explained in the Ex Libris article. As a best practice, add the following mitigation: Back up the Apache ssl.conf file Update the ssl.conf file with the following lines: SSLProtocol all -SSLv2 -SSLv3 SSLHonorCipherOrder on Replace the SSLCipherSuite setting with the following: SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128- GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM- SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128- SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA- AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256- SHA:ECDHE-ECDSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM- SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:!DES- CBC3- SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSSDES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA