[Openvas-discuss] weak ciphers on port 25

[Reindl Harald]

sorry, but that is pure nonsense for opportunstic TLS on a inbound mailserver because if you don#t support such ciphers clients which don#t support better ones will either fallback to *completly unencrypted* or just fail

Weak ciphers offered by this service:

 (custom override [Medium > Medium])

erride [Medium > Medium])

erride [Strong > Strong])

m override [Strong > Strong])

erride [Strong > Strong])

erride [Medium > Medium])

m override [Medium > Medium])

erride [Medium > Medium])

(custom override [Medium > Medium])

(custom override [Medium > Medium])

(custom override [Medium > Medium])

(custom override [Medium > Medium])

custom override [Medium > Medium])

er (custom override [Medium > Medium])

custom override [Medium > Medium])

custom override [Medium > Medium])

er (custom override [Medium > Medium])

custom override [Medium > Medium])

rride [Medium > Medium])

 (custom override [Medium > Medium])

erride [Medium > Medium])

erride [Strong > Strong])

m override [Strong > Strong])

erride [Strong > Strong])

erride [Medium > Medium])

m override [Medium > Medium])

erride [Medium > Medium])

(custom override [Medium > Medium])

(custom override [Medium > Medium])

(custom override [Medium > Medium])

(custom override [Medium > Medium])

custom override [Medium > Medium])

er (custom override [Medium > Medium])

custom override [Medium > Medium])

custom override [Medium > Medium])

er (custom override [Medium > Medium])

custom override [Medium > Medium])

rride [Medium > Medium])

ipher (custom override [Medium > Medium])

ipher (custom override [Medium > Medium])

her (custom override [Medium > Medium])

her (custom override [Medium > Medium])

her (custom override [Medium > Medium])

(custom override [Medium > Medium])

her (custom override [Medium > Medium])

her (custom override [Medium > Medium])

her (custom override [Medium > Medium])

(custom override [Medium > Medium])

(custom override [Medium > Medium])

ipher (custom override [Medium > Medium])

ipher (custom override [Medium > Medium])

her (custom override [Medium > Medium])

(custom override [Medium > Medium])

her (custom override [Medium > Medium])

 (custom override [Medium > Medium])

 (custom override [Medium > Medium])

stom override [Medium > Medium])

stom override [Medium > Medium])

ustom override [Medium > Medium])

Lösung


Schwachstellen-Einblick

These rules are applied for the evaluation of the cryptographic strength:

- Any SSL/TLS using no cipher is considered weak.



- RC4 is considered to be weak.









- Any other cipher is considered as strong
Methode zur Schwachstellenerkennung

Details: Check for SSL Weak Ciphers (OID: 1.3.6.1.4.1.25623.1.0.103440)

Benutzte Version: $Revision: 3061 $

TLS1_ECDH_anon_WITH_DES_192_CBC3_SHA : Medium cipher;No cipher;Weak cipher;Strong cipher? TLS1_RSA_DES_192_CBC3_SHA : Medium cipher;No cipher;Weak cipher;Strong cipher (custom ov? TLS1_ADH_WITH_AES_256_SHA : Strong cipher;No cipher;Weak cipher;Medium cipher (custom ov? TLS1_DHE_RSA_WITH_AES_256_SHA : Strong cipher;No cipher;Weak cipher;Medium cipher (custo? TLS1_RSA_WITH_AES_256_SHA : Strong cipher;No cipher;Weak cipher;Medium cipher (custom ov? TLS1_ADH_WITH_AES_128_SHA : Medium cipher;No cipher;Weak cipher;Strong cipher (custom ov? TLS1_DHE_RSA_WITH_AES_128_SHA : Medium cipher;No cipher;Weak cipher;Strong cipher (custo? TLS1_RSA_WITH_AES_128_SHA : Medium cipher;No cipher;Weak cipher;Strong cipher (custom ov? TLS1_ECDH_anon_WITH_AES_256_CBC_SHA : Medium cipher;No cipher;Weak cipher;Strong cipher ? TLS1_ECDH_anon_WITH_AES_128_CBC_SHA : Medium cipher;No cipher;Weak cipher;Strong cipher ? TLS1_ECDHE_RSA_WITH_AES_256_CBC_SHA : Medium cipher;No cipher;Weak cipher;Strong cipher ? TLS1_ECDHE_RSA_WITH_AES_128_CBC_SHA : Medium cipher;No cipher;Weak cipher;Strong cipher ? TLS1_ADH_WITH_CAMELLIA_256_CBC_SHA : Medium cipher;No cipher;Weak cipher;Strong cipher (? TLS1_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA : Medium cipher;No cipher;Weak cipher;Strong ciph? TLS1_RSA_WITH_CAMELLIA_256_CBC_SHA : Medium cipher;No cipher;Weak cipher;Strong cipher (? TLS1_ADH_WITH_CAMELLIA_128_CBC_SHA : Medium cipher;No cipher;Weak cipher;Strong cipher (? TLS1_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA : Medium cipher;No cipher;Weak cipher;Strong ciph? TLS1_RSA_WITH_CAMELLIA_128_CBC_SHA : Medium cipher;No cipher;Weak cipher;Strong cipher (? TLS1_ADH_DES_192_CBC_SHA : Medium cipher;No cipher;Weak cipher;Strong cipher (custom ove? TLS1_ECDH_anon_WITH_DES_192_CBC3_SHA : Medium cipher;No cipher;Weak cipher;Strong cipher? TLS1_RSA_DES_192_CBC3_SHA : Medium cipher;No cipher;Weak cipher;Strong cipher (custom ov? TLS1_ADH_WITH_AES_256_SHA : Strong cipher;No cipher;Weak cipher;Medium cipher (custom ov? TLS1_DHE_RSA_WITH_AES_256_SHA : Strong cipher;No cipher;Weak cipher;Medium cipher (custo? TLS1_RSA_WITH_AES_256_SHA : Strong cipher;No cipher;Weak cipher;Medium cipher (custom ov? TLS1_ADH_WITH_AES_128_SHA : Medium cipher;No cipher;Weak cipher;Strong cipher (custom ov? TLS1_DHE_RSA_WITH_AES_128_SHA : Medium cipher;No cipher;Weak cipher;Strong cipher (custo? TLS1_RSA_WITH_AES_128_SHA : Medium cipher;No cipher;Weak cipher;Strong cipher (custom ov? TLS1_ECDH_anon_WITH_AES_256_CBC_SHA : Medium cipher;No cipher;Weak cipher;Strong cipher ? TLS1_ECDH_anon_WITH_AES_128_CBC_SHA : Medium cipher;No cipher;Weak cipher;Strong cipher ? TLS1_ECDHE_RSA_WITH_AES_256_CBC_SHA : Medium cipher;No cipher;Weak cipher;Strong cipher ? TLS1_ECDHE_RSA_WITH_AES_128_CBC_SHA : Medium cipher;No cipher;Weak cipher;Strong cipher ? TLS1_ADH_WITH_CAMELLIA_256_CBC_SHA : Medium cipher;No cipher;Weak cipher;Strong cipher (? TLS1_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA : Medium cipher;No cipher;Weak cipher;Strong ciph? TLS1_RSA_WITH_CAMELLIA_256_CBC_SHA : Medium cipher;No cipher;Weak cipher;Strong cipher (? TLS1_ADH_WITH_CAMELLIA_128_CBC_SHA : Medium cipher;No cipher;Weak cipher;Strong cipher (? TLS1_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA : Medium cipher;No cipher;Weak cipher;Strong ciph? TLS1_RSA_WITH_CAMELLIA_128_CBC_SHA : Medium cipher;No cipher;Weak cipher;Strong cipher (? TLS1_ADH_DES_192_CBC_SHA : Medium cipher;No cipher;Weak cipher;Strong cipher (custom ove? TLS_1_2_ECDHE_RSA_WITH_AES_128_GCM_SHA256 : Medium cipher;No cipher;Weak cipher;Strong c? TLS_1_2_ECDHE_RSA_WITH_AES_128_CBC_SHA256 : Medium cipher;No cipher;Weak cipher;Strong c? TLS_1_2_DH_anon_WITH_AES_128_GCM_SHA256 : Medium cipher;No cipher;Weak cipher;Strong cip? TLS_1_2_DH_anon_WITH_AES_256_CBC_SHA256 : Medium cipher;No cipher;Weak cipher;Strong cip? TLS_1_2_DH_anon_WITH_AES_128_CBC_SHA256 : Medium cipher;No cipher;Weak cipher;Strong cip? TLS_1_2_RSA_WITH_AES_128_GCM_SHA256 : Medium cipher;No cipher;Weak cipher;Strong cipher ? TLS_1_2_DHE_RSA_WITH_AES_128_GCM_SHA256 : Medium cipher;No cipher;Weak cipher;Strong cip? TLS_1_2_DHE_RSA_WITH_AES_256_CBC_SHA256 : Medium cipher;No cipher;Weak cipher;Strong cip? TLS_1_2_DHE_RSA_WITH_AES_128_CBC_SHA256 : Medium cipher;No cipher;Weak cipher;Strong cip? TLS_1_2_RSA_WITH_AES_256_CBC_SHA256 : Medium cipher;No cipher;Weak cipher;Strong cipher ? TLS_1_2_RSA_WITH_AES_128_CBC_SHA256 : Medium cipher;No cipher;Weak cipher;Strong cipher ? TLS_1_2_ECDHE_RSA_WITH_AES_256_GCM_SHA384 : Medium cipher;No cipher;Weak cipher;Strong c? TLS_1_2_ECDHE_RSA_WITH_AES_256_CBC_SHA384 : Medium cipher;No cipher;Weak cipher;Strong c? TLS_1_2_DH_anon_WITH_AES_256_GCM_SHA384 : Medium cipher;No cipher;Weak cipher;Strong cip? TLS_1_2_RSA_WITH_AES_256_GCM_SHA384 : Medium cipher;No cipher;Weak cipher;Strong cipher ? TLS_1_2_DHE_RSA_WITH_AES_256_GCM_SHA384 : Medium cipher;No cipher;Weak cipher;Strong cip? TLS_1_2_DHE_RSA_WITH_AES_256_CBC_SHA : Medium cipher;No cipher;Weak cipher;Strong cipher? TLS_1_2_DHE_RSA_WITH_AES_128_CBC_SHA : Medium cipher;No cipher;Weak cipher;Strong cipher? TLS_1_2_RSA_WITH_AES_256_CBC_SHA : Medium cipher;No cipher;Weak cipher;Strong cipher (cu? TLS_1_2_RSA_WITH_AES_128_CBC_SHA : Medium cipher;No cipher;Weak cipher;Strong cipher (cu? TLS_1_2_RSA_WITH_3DES_EDE_CBC_SHA : Medium cipher;No cipher;Weak cipher;Strong cipher (c? The configuration of this services should be changed so that it does not support the listed weak ciphers anymore. - All SSLv2 ciphers are considered weak due to a design flaw within the SSLv2 protocol. - Ciphers using 64 bit or less are considered to be vulnerable to brute force methods and therefore considered as weak. - 1024 bit RSA authentication is considered to be insecure and therefore as weak. - CBC ciphers in TLS < 1.2 are considered to be vulnerable to the BEAST or Lucky 13 attacks - Any cipher considered to be secure for only the next 10 years is considered as medium

signature.asc
Description: OpenPGP digital signature

_______________________________________________
Openvas-discuss mailing list
Openvas-discuss@wald.intevation.org
https://lists.wald.intevation.org/cgi-bin/mailman/listinfo/openvas-discuss