tcnative CVE-2015-4000 (Logjam) (UNCLASSIFIED)

2015-06-30 Thread Wunder, Greg P CTR (US)
Classification: UNCLASSIFIED Caveats: NONE http://mail-archives.apache.org/mod_mbox/tomcat-users/201506.mbox/%3c557cce04.4020...@mediture.com%3E Related to this link here, does anyone have a binary distro for Windows x86 and x64 for Tomcat 8.0.23 of tcnative-1.dll that is version 1.1.34? I've be

Re: tcnative CVE-2015-4000 (Logjam)

2015-06-15 Thread Mark Thomas
On 15/06/2015 16:29, Arthur Ramsey wrote: > I haven't that would have helped a while back. Did that exist back when > Heartbleed was discovered? No. I put it together when I was trying to do the release builds post heartbleed. Mark > > On 06/15/2015 10:28 AM, Mark Thomas wrote: >> On 15/06/201

Re: tcnative CVE-2015-4000 (Logjam)

2015-06-15 Thread Arthur Ramsey
I haven't that would have helped a while back. Did that exist back when Heartbleed was discovered? On 06/15/2015 10:28 AM, Mark Thomas wrote: On 15/06/2015 16:22, Arthur Ramsey wrote: Agreed, I probably wouldn't trust some random binary :P, but documentation is fairly lacking on building t

Re: tcnative CVE-2015-4000 (Logjam)

2015-06-15 Thread Mark Thomas
On 15/06/2015 16:22, Arthur Ramsey wrote: >> Agreed, I probably wouldn't trust some random binary :P, but >> documentation is fairly lacking on building tcnative for windows x64 and >> it requires commercial software. Have you seen this? http://wiki.apache.org/tomcat/BuildTcNativeWin Mark --

Re: tcnative CVE-2015-4000 (Logjam)

2015-06-15 Thread Arthur Ramsey
On 06/15/2015 09:50 AM, Christopher Schultz wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Arthur, On 6/13/15 8:42 PM, Arthur Ramsey wrote: I have working binaries for Linux x64 and Windows x64 if anyone needs them. Thanks for offering, but: 1. Anyone running Linux should be able to

Re: tcnative CVE-2015-4000 (Logjam)

2015-06-15 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Arthur, On 6/13/15 8:42 PM, Arthur Ramsey wrote: > I have working binaries for Linux x64 and Windows x64 if anyone > needs them. Thanks for offering, but: 1. Anyone running Linux should be able to trivially build their own. 2. Anyone wanting Arth

Re: tcnative CVE-2015-4000 (Logjam)

2015-06-13 Thread Arthur Ramsey
I have working binaries for Linux x64 and Windows x64 if anyone needs them. It should still work with newer versions of tomcat 7 providing the SSLProtocol is set to TLSv1? The Windows binary has SSLv2 and SSLv3 disabled at compile time. On 6/13/2015 3:30 PM, Arthur Ramsey wrote: Building the

Re: tcnative CVE-2015-4000 (Logjam)

2015-06-13 Thread Arthur Ramsey
Building the latest from svn branch 1.1.x seems to work. I had to do some modifications to get TLSv1.1 and TLSv1.2 when using |SSLProtocol="all" |because I'm using tomcat 7.0.55. Thanks for the help, Arthur On 6/11/2015 3:34 PM, Arthur Ramsey wrote: On 06/11/2015 02:35 PM, Christopher Schult

Re: tcnative CVE-2015-4000 (Logjam)

2015-06-12 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Rainer, On 6/12/15 6:32 AM, Rainer Jung wrote: > With existing 1.1.33 you can choose your cipher suite, so that > non-DHE ciphers come first and set SSLHonorCipherOrder such that > the client chooses the first matching cipher and DHE will likely > n

Re: tcnative CVE-2015-4000 (Logjam)

2015-06-12 Thread Rainer Jung
Am 12.06.2015 um 04:01 schrieb Christopher Schultz: -BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Arthur, On 6/11/15 4:34 PM, Arthur Ramsey wrote: On 06/11/2015 02:35 PM, Christopher Schultz wrote: Arthur, On 6/11/15 2:14 PM, Arthur Ramsey wrote: Is anyone aware of a way to mitigate the Lo

Re: tcnative CVE-2015-4000 (Logjam)

2015-06-11 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Arthur, On 6/11/15 4:34 PM, Arthur Ramsey wrote: > On 06/11/2015 02:35 PM, Christopher Schultz wrote: Arthur, > > On 6/11/15 2:14 PM, Arthur Ramsey wrote: Is anyone aware of a way to mitigate the Logjam attack with tomcat 7 and java 7? >

Re: tcnative CVE-2015-4000 (Logjam)

2015-06-11 Thread Arthur Ramsey
On 06/11/2015 02:35 PM, Christopher Schultz wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Arthur, On 6/11/15 2:14 PM, Arthur Ramsey wrote: Is anyone aware of a way to mitigate the Logjam attack with tomcat 7 and java 7? Disable DHE_EXPORT on the server? I believe I have, but Qualys S

Re: tcnative CVE-2015-4000 (Logjam)

2015-06-11 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Arthur, On 6/11/15 2:14 PM, Arthur Ramsey wrote: > Is anyone aware of a way to mitigate the Logjam attack with tomcat > 7 and java 7? Disable DHE_EXPORT on the server? > I use tcnative and openssl-1.0.2a both compiled from source in > production

tcnative CVE-2015-4000 (Logjam)

2015-06-11 Thread Arthur Ramsey
Is anyone aware of a way to mitigate the Logjam attack with tomcat 7 and java 7? I use tcnative and openssl-1.0.2a both compiled from source in production today, but I would be open to JSSE too. I believe I need Java 8 to mitigate CVE-2015-4000 with JSSE. I don't see anyway to use a unique 2