Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I'm trying to pass a pci scan, I'm on Ubuntu 12.04 lts server and Nginx. I've tried everything I know and did a lot of research... apparently seems that need to disable a setting in OpenSSL which I can't find how to do.

This is the result of the scan:

SSL/TLS Protocol Initialization Vector Implementation Information Disclosure Vulnerability www (443/tcp)

CVSS Score: Medium 4.3 - Fail

CVE-2011-3389

and this is the suggested fix by the pci scanner company:

Configure SSL/TLS servers to only use TLS 1.1 or TLS 1.2 if supported. Configure SSL/TLS servers to only support cipher suites that do not use block ciphers. Apply patches if available.

OpenSSL uses empty fragments as a countermeasure unless the 'SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS' option is specified when OpenSSL is initialized.

I don't know how to do this, I've tried it all, please help I'm going crazy :)

How do I disable this SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS option???

Note: tlsv1.1 and tlsv1.2 are not enabled right now. I upgraded to latest verions of all (Ubuntu 12.04 lts, nginx1.2.7 and openSSL 1.0.1 ). I've read that the latest versions takes care of the the issue (tls being not supported by default). But I'm getting the exact same report from the scan.

See Below my web server configuration, I did everything I had to with ciphers, still getting the same result:

server {

    listen 192.xxx.xx.xx:443 ssl;

      server_name mydomain.org alias *.mydomain.org;

    keepalive_timeout   70;

    # ssl_ciphers RC4:HIGH:!aNULL:!MD5:!kEDH;

    ssl_ciphers ECDHE-RSA-AES128-SHA256:AES128-GCM-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH;

    ssl_prefer_server_ciphers on;

    ssl_protocols SSLv3 TLSv1.1 TLSv1.2;


    ssl_session_cache shared:SSL:10m;

    ssl_session_timeout 10m;
share|improve this question

1 Answer 1

This sounds like a false-positive. If you are running the latest OpenSSL package on 12.04, then you should not be affected.

According to this update released a few days ago, the OpenSSL package is not affected and Nginx is not listed as an affected package as far as this CVE is concerned.

I would recommend going through the list in the link provided above and see if there are any packages installed on the system which might be affected by this vulnerability.

The latest release in the repository for OpenSSL is 1.0.1-4ubuntu5.7 and should already have counter-measures in place for this vulnerability as this was patched upstream by Debian some time ago. See Launchpad for more details.

If none of these packages are on your system, I would question the validity of the software that alerted you (Does it have all of the latest CVE signatures?, etc) and check your system again with another scanner if at all possible.

share|improve this answer
    
Thank you so much maggotbrain. Would you be able to tell me how to download and install the newer patch from the commandline? –  Chaimy Mar 1 '13 at 7:04
    
Sorry, I'm a little confused. Which version should I download? I have the latest one, I used apt-get. what should I do next? –  Chaimy Mar 1 '13 at 7:25
1  
good idea! I will try a different pci scan software, I see the "Not Affected" sign on ubuntu 12.04 at the openssl list. besides, is there a way to enable tlsv1.1 and tlsv1.2 which are now disabled? –  Chaimy Mar 1 '13 at 7:44
    
@Chaimy Excellent. I would recommend starting a new question just specifically on configuring TLS. –  Kevin Bowen Mar 1 '13 at 7:53
    
thanks again dude. –  Chaimy Mar 1 '13 at 8:09

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.