You are viewing a plain text version of this content. The canonical link for it is here.
Posted to bugs@httpd.apache.org by bu...@apache.org on 2015/04/10 19:56:39 UTC
[Bug 57803] New: Unable to turn off SSL-V3
https://bz.apache.org/bugzilla/show_bug.cgi?id=57803
Bug ID: 57803
Summary: Unable to turn off SSL-V3
Product: Apache httpd-2
Version: 2.2.15
Hardware: PC
Status: NEW
Severity: normal
Priority: P2
Component: Core
Assignee: bugs@httpd.apache.org
Reporter: hjohnson@bmc.com
Trying to disable SSL-V3 to get around the POODLE SSL-V3 security
vulnerability. The recommended steps do not seem to have the desired effect.
1. Stop httpd service
2. Add the following line in the httpd-ssl.conf file in the "SSL Cipher Suite"
section:
SSLProtocol all -SSLv2 -SSLv3
3. Restart httpd service
Expected Result: SSL-V3 should no longer appear when running nmap security scan
against the Apache server
Actual Result: SSL-V3 continues to show up, e.g.,
Nmap scan report for <host name witheld> (123.45.67.89)
Host is up (0.0065s latency).
Not shown: 983 closed ports
PORT STATE SERVICE
80/tcp open http
135/tcp open msrpc
139/tcp open netbios-ssn
443/tcp open https
| ssl-enum-ciphers:
|_ SSLv3: No supported ciphers found
445/tcp open microsoft-ds
1099/tcp open rmiregistry
1100/tcp open mctp
2010/tcp open search
3389/tcp open ms-wbt-server
5001/tcp open commplex-link
8008/tcp open http
8081/tcp open blackice-icecap
8082/tcp open blackice-alerts
8093/tcp open unknown
49152/tcp open unknown
49153/tcp open unknown
49154/tcp open unknown
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 57803] Unable to turn off SSL-V3
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=57803
Howell Johnson <hj...@bmc.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Resolution|--- |FIXED
Status|NEEDINFO |RESOLVED
--- Comment #2 from Howell Johnson <hj...@bmc.com> ---
Apologies - we had mis-interpreted the nmap output. The feature is working as
expected. Closing this bug.
Including for reference a sample nmap output where SSLV3 *is* supported:
Nmap scan report for 123.45.67.89
Host is up (0.019s latency).
PORT STATE SERVICE
443/tcp open https
| ssl-enum-ciphers:
| SSLv3:
| ciphers:
| TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA - strong
| TLS_DHE_RSA_WITH_AES_128_CBC_SHA - strong
| TLS_DHE_RSA_WITH_AES_256_CBC_SHA - strong
| TLS_RSA_WITH_3DES_EDE_CBC_SHA - strong
| TLS_RSA_WITH_AES_128_CBC_SHA - strong
| TLS_RSA_WITH_AES_256_CBC_SHA - strong
| TLS_RSA_WITH_RC4_128_SHA - strong
| compressors:
| NULL
| TLSv1.0:
| ciphers:
| TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA - strong
| TLS_DHE_RSA_WITH_AES_128_CBC_SHA - strong
| TLS_DHE_RSA_WITH_AES_256_CBC_SHA - strong
| TLS_RSA_WITH_3DES_EDE_CBC_SHA - strong
| TLS_RSA_WITH_AES_128_CBC_SHA - strong
| TLS_RSA_WITH_AES_256_CBC_SHA - strong
| TLS_RSA_WITH_RC4_128_SHA - strong
| compressors:
| NULL
|_ least strength: strong
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 57803] Unable to turn off SSL-V3
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=57803
Eric Covener <co...@gmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |NEEDINFO
OS| |All
--- Comment #1 from Eric Covener <co...@gmail.com> ---
Nothing there shows SSLv3 was supported after you disabled it.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org