Weak Ciphers Enabled
Severity: Medium
Summary #
Invicti detected that weak ciphers are enabled during secure communication (SSL).
You should allow only strong ciphers on your web server to protect secure communication with your visitors.
Impact #
Attackers might decrypt SSL traffic between your server and your visitors.
Actions To Take #
- For Apache, you should modify the SSLCipherSuite directive in the
httpd.conf.SSLCipherSuite HIGH:MEDIUM:!MD5:!RC4
- Lighttpd:
ssl.honor-cipher-order = "enable" ssl.cipher-list = "EECDH+AESGCM:EDH+AESGCM"
- For Microsoft IIS, you should make some changes to the system registry. Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on your computer.
a. Click Start, click Run, typeregedt32or typeregedit, and then click OK.
b. In Registry Editor, locate the following registry key:HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders
c. Set "Enabled" DWORD to "0x0" for the following registry keys:
SCHANNEL\Ciphers\DES 56/56
SCHANNEL\Ciphers\RC4 64/128
SCHANNEL\Ciphers\RC4 40/128
SCHANNEL\Ciphers\RC2 56/128
SCHANNEL\Ciphers\RC2 40/128
SCHANNEL\Ciphers\NULL
SCHANNEL\Hashes\MD5
Remediation #
Configure your web server to disallow using weak ciphers.
Classifications #
PCI v3.2-6.5.4; CAPEC-217; CWE-327; ISO27001-A.14.1.3; WASC-4; OWASP 2013-A6; OWASP 2017-A3
, CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Vulnerability Index
You can search and find all vulnerabilities
Select Category
OR
Search Vulnerability
