CVE-2016-2183 SWEET32 (Birthday Attack) vulnerability

Products

• CA Identity Manager
• CA Identity Governance
• CA Identity Portal
• CA Identity Suite

Issue/Introduction

The SWEET32 (Birthday Attack) is a Medium level vulnerability which is prevalent in TLS 1.0 and TLS 1.1 which support 3DES Encryption. To resolve this issue you should deploy TLS 1.2 as a minimum (the 3DES cypher is dropped by default) and disable vulnerable ciphers. 

 

* (Reference: https://www.openssl.org/blog/blog/2016/08/24/sweet32/)

Environment

Release : 14.x

Component : IdentityMinder(Identity Manager)

Resolution

To disable TLS 1.0 and TLS 1.1 please follow the instructions as per the product documentation. 

 

https://techdocs.broadcom.com/us/en/symantec-security-software/identity-security/identity-manager/14-3/reference/advanced-configuration-options/domain-configuration/tls-configuration.html

 

In addition, add the following ciphers to jdk.tls.disabledAlgorithms parameter in Connector Server/jvm/lib/security/java.security file

 

jdk.tls.disabledAlgorithms=SSLv3, RC4, DH keySize < 768, SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA

Additional Information

 

* CA Broadcom Is not responsible for third party content