Tls1 and renegotiation vulnerabilities

[swiars]

Hello ,

We have 2 vulnerability on our dmz servers.
first one is about tls1.0 . I know that we can resolve this issue with “enable encryption” on bes admin.

our tls1.0 reg key is “disabled=1” . But our securtiy team didn’t accept this.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server

Disabled=“1”

second one is aboute renegotiation. as I talked with case there is no customization about blocking renegotiation.

do you have any advice about both vulnerabilities ? did you faced with renegotiation vulnerabilities?

[JasonWalker]

May need some more details about what your team’s actual findings are.

BigFix itself doesn’t use SCHANNEL for communications, we use OpenSSL.

Microsoft SCHANNEL and BigFix protocols can be configured independently, just need to start by determining which one is the issue.

[swiars]

Hello Jason ,

SCHANNEL is different you are right.
they found this vulnerability on 52311 port. (It’s about SSL) .we can secure it with “enhanced security” option.

For the second vulnerability ( ssl renegotiation ) , do you have any advice ?

thank you.

[swiars]

hello ,

do you have experience about renegotiation ? If it is secure, are we safe ?