Skip to main content

Poodle post - catastrophic bug of the month

Posted by: admin 10 years, 1 month ago

Wow, when will it stop?

Luckily, this one is not too bad.  Please read Errata Security's review of the bug for background.   The risk is a Man-in-the-middle attack against your WiKIDAdmin login.  Since your WiKIDAdmin should be locked down to the inside of your firewall this should be a difficult attack.  You should disable SSLv3 on your browser as that will protect you at all sites, not just the WiKIDAdmin.  We will be disabling SSLv3 in the WiKIDAdmin soon, but we don't see this as a major risk at this time.  If you want to disable SSLv3 right now you can edit /opt/WiKID/tomcat/conf/server.xml and change the Connector information for 443 to this:

 <Connector port="443" protocol="HTTP/1.1" SSLEnabled="true"
 maxThreads="150" scheme="https" secure="true" sslEnabledProtocols="TLSv1, TLSv1.2"
 ciphers="TLS_RSA_WITH_AES_128_CBC_SHA"
 keystorePass="passphrase" keystoreFile="/opt/WiKID/conf/tomcatKeystore"
 clientAuth="false" sslProtocol="TLS" />

And restart the WiKID service.  This will allow only TLSv1 and 1.2 for tomcat.  Note once again the the software tokens use public-private key pairs for the PIN and OTP exchange so they do not use SSL!  This only affects the WiKIDAdmin interface.    The wAuth protocol uses client-side certificates and is not affected either.

Also, note the benefit of using two-factor authentication.  While a successful MiTM can get any information, grabbing credentials allows you to login any time.  If you are not using two-factor auth, give the WiKID server a spin!

 

Current rating: 1

Recent Posts

Archive

2024
2022
2021
2019
2018
2017
2016
2015
2014
2013
2012
2011
2010
2009
2008

Categories

Tags

Authors

Feeds

RSS / Atom