Hello, We're performing PCI audit security scan on our machines and this one vulnerability keeps coming back on our apache 2.2 server. I followed the solution is provided and changed the line ssl/ssl.h (0x00000FFFL -> 0x00000FFFL^SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG and also added the entire line #define SSL_OP_ALL (0x00000FFFL^SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG) to openssl/ssl.h which was otherwise blank. After the changes, I recompiled openssl-0.9.8e and moved over libeay32.dll, ssleay32.dll, and openssl.exe to the bin directory of the apache server. Do I have to recompile apache as well? Thanks for your help!
Netscape/OpenSSL Cipher Forcing Bug THREAT: Netscape's SSLv3 implementation had a bug where if a SSLv3 connection is initially established, the first available cipher is used. If a session is resumed, a different cipher may be chosen if it appears in the passed cipher list before the session's current cipher. This bug can be used to change ciphers on the server. OpenSSL contains this bug if the SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG option is enabled during runtime. This option was introduced for compatibility reasons. The problem arises when different applications using OpenSSL's libssl library enable all compatibility options including SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG, thus enabling the bug. IMPACT: A malicious legitimate client can enforce a ciphersuite not supported by the server to be used for a session between the client and the server. This can result in disclosure of sensitive information. SOLUTION: This problem can be fixed by disabling the SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG option from the options list of OpenSSL's libssl library. This can be done by replacing the SSL_OP_ALL definition in the openssl/ssl.h file with the following line: #define SSL_OP_ALL (0x00000FFFL^SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG) The library and all programs using this library need to be recompiled to ensure that the correct OpenSSL library is used during linking. Sojanna Mun American Cancer Society - Corporate IT 250 Williams Street Atlanta, GA 30303 404-329-7633 ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List openssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
