{"id":9057,"date":"2015-07-09T10:34:19","date_gmt":"2015-07-09T02:34:19","guid":{"rendered":"http:\/\/w3c.weblink.com.tw\/symantec\/?p=9057"},"modified":"2015-07-09T10:34:19","modified_gmt":"2015-07-09T02:34:19","slug":"about-data-center-security-server-advanced-and-the-poodle-ssl-3-0-vulnerability-cve-2014-3566","status":"publish","type":"post","link":"https:\/\/w3c.weblink.com.tw\/symantec\/?p=9057","title":{"rendered":"About Data Center Security: Server (Advanced) and the Poodle SSL 3.0 vulnerability (CVE-2014-3566)"},"content":{"rendered":"<h5>Problem<\/h5>\n<p>&nbsp;<\/p>\n<p>A security bug affecting SSL 3.0 was released on October 14, 2014.<\/p>\n<p>&nbsp;<\/p>\n<h5>Solution<\/h5>\n<p>&nbsp;<\/p>\n<p>The DCS 6.0.x and CSP 5.2.9 Manager utilize a version of SSL 3.0 that is susceptible to POODLE. Customers should add the entry sslEnabledProtocols=&#8221;TLSv1,TLSv1.1,TLSv1.2&#8243; to &lt;server install&gt;\\tomcat\\conf\\server.xml. All future release will contain this change by default. <\/p>\n<p>Recommend steps: <\/p>\n<ol>\n<li>Stop CSP\/DCS manager service<\/li>\n<li>Take backup of Server.xml file<\/li>\n<li>Edit the server.xml file to make the suggested changes using xml editors to ensure that double quotes (&#8220;) with appropriate encoding will be used.<\/li>\n<li>Start CSP\/DCS manager service<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p><b>CSP Server 5.2.9 MP1 &#8211; MP5 (having Tomcat 7.x)<\/b> <\/p>\n<p><b>DCS:SA Server 6.0, 6.0 MP1 (having Tomcat 7.x)<\/b> <\/p>\n<p>The entry sslEnabledProtocols=&#8221;TLSv1,TLSv1.1,TLSv1.2&#8243; needs to be added to the three SSL Connector configured in server.xml. <\/p>\n<p>&nbsp; <\/p>\n<p>These SSL Connectors are for the: <\/p>\n<ul>\n<li>Tomcat Stand-Alone Agent Service<\/li>\n<li>Tomcat Stand-Alone Console Service<\/li>\n<li>Tomcat Stand-Alone Service<\/li>\n<\/ul>\n<p>&nbsp; <\/p>\n<p>The following example shows this change: <\/p>\n<p><i><font size=\"1\">&lt;Connector port=&#8221;%AGENT_PORT% \/ %CONSOLE_PORT% \/ %ADMIN_PORT%&#8221;<\/font><\/i> <\/p>\n<blockquote>\n<p><font size=\"1\">maxThreads=&#8221;200&#8243; minSpareThreads=&#8221;50&#8243; enableLookups=&#8221;false&#8221; disableUploadTimeout=&#8221;true&#8221; maxKeepAliveRequests=&#8221;1&#8243;<\/font> <\/p>\n<p><font size=\"1\">acceptCount=&#8221;25&#8243; scheme=&#8221;https&#8221; secure=&#8221;true&#8221; SSLEnabled=&#8221;true&#8221;<\/font> <\/p>\n<p><font size=\"1\">keystorePass=&#8221;&lt;KeyStorePassword&gt;&#8221;<\/font> <\/p>\n<p><font size=\"1\">keystoreFile=&#8221;&lt;KeyStoreFilePath&gt;&#8221;<\/font> <\/p>\n<p><font size=\"1\">clientAuth=&#8221;false&#8221; sslProtocol=&#8221;TLS&#8221; <b><font style=\"background-color: #ffff00\">sslEnabledProtocols=&#8221;TLSv1,TLSv1.1,TLSv1.2&#8243;<\/font><\/b><\/font> <\/p>\n<p><font size=\"1\">ciphers=&#8221;%comma_separated_list_of_ciphers%&#8221;\/&gt;<\/font><\/p>\n<\/blockquote>\n<p><em><\/em>&nbsp; <\/p>\n<p><i><font size=\"1\">&lt;Connector port=&#8221;%AGENT_PORT% \/ %CONSOLE_PORT% \/ %ADMIN_PORT%&#8221;<\/font><\/i> <\/p>\n<blockquote>\n<p><font size=\"1\">maxThreads=&#8221;40&#8243; minSpareThreads=&#8221;10&#8243; enableLookups=&#8221;false&#8221;<\/font> <\/p>\n<p><font size=\"1\">disableUploadTimeout=&#8221;true&#8221; maxKeepAliveRequests=&#8221;1&#8243;<\/font> <\/p>\n<p><font size=\"1\">acceptCount=&#8221;10&#8243; scheme=&#8221;https&#8221; secure=&#8221;true&#8221; SSLEnabled=&#8221;true&#8221;<\/font> <\/p>\n<p><font size=\"1\">keystorePass=&#8221;&lt;KeyStorePassword&gt;&#8221;<\/font> <\/p>\n<p><font size=\"1\">keystoreFile=&#8221;&lt;KeyStoreFilePath&gt;&#8221;<\/font> <\/p>\n<p><font size=\"1\">clientAuth=&#8221;false&#8221; sslProtocol=&#8221;TLS&#8221; <b><font style=\"background-color: #ffff00\">sslEnabledProtocols=&#8221;TLSv1,TLSv1.1,TLSv1.2&#8243;<\/font><\/b><\/font> <\/p>\n<p><font size=\"1\">ciphers=&#8221;%comma_separated_list_of_ciphers%&#8221;\/&gt;<\/font><\/p>\n<\/blockquote>\n<p><em><\/em>&nbsp; <\/p>\n<p><b>CSP Server 5.2.8 \u2013 5.2.8 MP4 and 5.2.9 (having tomcat 5.x):<\/b> <\/p>\n<p>The entry sslProtocols=&#8221;TLSv1,TLSv1.1,TLSv1.2&#8243; needs to be added to the following SSL Connector configured in server.xml. <\/p>\n<ul>\n<li>Tomcat Stand-Alone Service<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<p>The entry sslProtocols=&#8221;SSLv2Hello,TLSv1,TLSv1.1,TLSv1.2&#8243; needs to be added to the following SSL Connector configured in server.xml. <\/p>\n<ul>\n<li>Tomcat Stand-Alone Console Service<\/li>\n<li>Tomcat Stand-Alone Agent Service<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<p>The following example shows this change: <\/p>\n<p><i>&lt;Connector port=&#8221;%AGENT_PORT% \/ %CONSOLE_PORT% \/ %ADMIN_PORT%&#8221;<\/i> <\/p>\n<blockquote>\n<p><font size=\"1\">maxThreads=&#8221;200&#8243; minSpareThreads=&#8221;50&#8243; maxSpareThreads=&#8221;100&#8243;<\/font> <\/p>\n<p><font size=\"1\">enableLookups=&#8221;false&#8221; disableUploadTimeout=&#8221;true&#8221; maxKeepAliveRequests=&#8221;1&#8243;<\/font> <\/p>\n<p><font size=\"1\">acceptCount=&#8221;25&#8243; debug=&#8221;0&#8243; scheme=&#8221;https&#8221; secure=&#8221;true&#8221;<\/font> <\/p>\n<p><font size=\"1\">keystorePass=&#8221;&lt;KeyStorePassword&gt;&#8221;<\/font> <\/p>\n<p><font size=\"1\">keystoreFile=&#8221;&lt;KeyStoreFilePath&gt;&#8221;<\/font> <\/p>\n<p><font size=\"1\">clientAuth=&#8221;false&#8221; sslProtocol=&#8221;TLS&#8221; <b><font style=\"background-color: #ffff00\">sslProtocols=&#8221;SSLv2Hello,TLSv1,TLSv1.1,TLSv1.2&#8243;<\/font><\/b><\/font> <\/p>\n<p><font size=\"1\">ciphers=&#8221;%comma_separated_list_of_ciphers%&#8221;\/&gt;<\/font> <\/p>\n<p>&nbsp;<\/p>\n<\/blockquote>\n<p><i><\/i> <\/p>\n<p><i>&lt;Connector port=&#8221;%AGENT_PORT% \/ %CONSOLE_PORT% \/ %ADMIN_PORT%&#8221;<\/i> <\/p>\n<blockquote>\n<p>maxThreads=&#8221;40&#8243; minSpareThreads=&#8221;10&#8243; maxSpareThreads=&#8221;25&#8243; <\/p>\n<p>enableLookups=&#8221;false&#8221; disableUploadTimeout=&#8221;true&#8221; maxKeepAliveRequests=&#8221;1&#8243; <\/p>\n<p>acceptCount=&#8221;10&#8243; debug=&#8221;0&#8243; scheme=&#8221;https&#8221; secure=&#8221;true&#8221; <\/p>\n<p>keystorePass=&#8221;&lt;KeyStorePassword&gt;&#8221; <\/p>\n<p>keystoreFile=&#8221;&lt;KeyStoreFilePath&gt;&#8221; <\/p>\n<p>clientAuth=&#8221;false&#8221; sslProtocol=&#8221;TLS&#8221; <b><font style=\"background-color: #ffff00\">sslProtocols=&#8221;SSLv2Hello,TLSv1,TLSv1.1,TLSv1.2&#8243;<\/font><\/b> <\/p>\n<p>ciphers=&#8221;%comma_separated_list_of_ciphers%&#8221;\/&gt; <\/p>\n<p>&nbsp;<\/p>\n<\/blockquote>\n<p><i><\/i> <\/p>\n<p><i>&lt;Connector port=&#8221;%AGENT_PORT% \/ %CONSOLE_PORT% \/ %ADMIN_PORT%&#8221;<\/i> <\/p>\n<blockquote>\n<p>maxThreads=&#8221;55&#8243; minSpareThreads=&#8221;5&#8243; maxSpareThreads=&#8221;8&#8243; <\/p>\n<p>enableLookups=&#8221;false&#8221; acceptCount=&#8221;10&#8243; maxKeepAliveRequests=&#8221;1&#8243; debug=&#8221;0&#8243; <\/p>\n<p>connectionTimeout=&#8221;20000&#8243; scheme=&#8221;https&#8221; disableUploadTimeout=&#8221;true&#8221; secure=&#8221;true&#8221; <\/p>\n<p>keystorePass=&#8221;&lt;KeyStorePassword&gt;&#8221; <\/p>\n<p>keystoreFile=&#8221;&lt;KeyStoreFilePath&gt;&#8221; <\/p>\n<p>clientAuth=&#8221;false&#8221; sslProtocol=&#8221;TLS&#8221; <b><font style=\"background-color: #ffff00\">sslProtocols=&#8221;TLSv1,TLSv1.1,TLSv1.2&#8243;<\/font><\/b> <\/p>\n<p>ciphers=&#8221;%comma_separated_list_of_ciphers%&#8221;\/&gt;<\/p>\n<\/blockquote>\n<p><strong> &#8212;<\/strong> <\/p>\n<p><strong>This issue has been addressed in SCSP 5.2.9 MP6<\/strong> <\/p>\n<p><strong>Symantec Critical System Protection 5.2 RU9 MP6 uses only the TLSv1x protocol to communicate among the server, agent, and console.<\/strong> <\/p>\n<p><strong>&#8212;<\/strong> <\/p>\n<h5>References<\/h5>\n<p>&nbsp;<\/p>\n<p><a title=\"https:\/\/support.symantec.com\/en_US\/article.TECH225827.html\" href=\"https:\/\/support.symantec.com\/en_US\/article.TECH225827.html\">https:\/\/support.symantec.com\/en_US\/article.TECH225827.html<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Problem &nbsp; A security bug affecting SSL 3.0 was rel &hellip; <a href=\"https:\/\/w3c.weblink.com.tw\/symantec\/?p=9057\" class=\"more-link\">\u95b1\u8b80\u5168\u6587 <span class=\"screen-reader-text\">About Data Center Security: Server (Advanced) and the Poodle SSL 3.0 vulnerability (CVE-2014-3566)<\/span><\/a><\/p>\n","protected":false},"author":19,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[126],"tags":[],"class_list":["post-9057","post","type-post","status-publish","format-standard","hentry","category-ssl-3-0-"],"_links":{"self":[{"href":"https:\/\/w3c.weblink.com.tw\/symantec\/index.php?rest_route=\/wp\/v2\/posts\/9057","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/w3c.weblink.com.tw\/symantec\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/w3c.weblink.com.tw\/symantec\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/w3c.weblink.com.tw\/symantec\/index.php?rest_route=\/wp\/v2\/users\/19"}],"replies":[{"embeddable":true,"href":"https:\/\/w3c.weblink.com.tw\/symantec\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=9057"}],"version-history":[{"count":1,"href":"https:\/\/w3c.weblink.com.tw\/symantec\/index.php?rest_route=\/wp\/v2\/posts\/9057\/revisions"}],"predecessor-version":[{"id":9058,"href":"https:\/\/w3c.weblink.com.tw\/symantec\/index.php?rest_route=\/wp\/v2\/posts\/9057\/revisions\/9058"}],"wp:attachment":[{"href":"https:\/\/w3c.weblink.com.tw\/symantec\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=9057"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/w3c.weblink.com.tw\/symantec\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=9057"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/w3c.weblink.com.tw\/symantec\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=9057"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}