CVE-2016-2183 SWEET32 (Birthday Attack) vulnerability

Products

• CA Identity Manager
• CA Identity Governance
• CA Identity Portal
• CA Identity Suite

Issue/Introduction

The SWEET32 (Birthday Attack) is a Medium level vulnerability which is prevalent in TLS 1.0 and TLS 1.1 which support 3DES Encryption. To resolve this issue you should deploy TLS 1.2 as a minimum (the 3DES cypher is dropped by default) and disable vulnerable ciphers. 

Environment

Release : 14.x

Component : IdentityMinder(Identity Manager)

Resolution

To disable TLS 1.0 and TLS 1.1 please follow the instructions as per the product documentation. 

for IM 14.5 - TLS Configuration

for vApp 14.5 - Disable TLS v1.0 and v1.1

In addition, add the following ciphers to jdk.tls.disabledAlgorithms parameter in Connector Server/jvm/lib/security/java.security file

jdk.tls.disabledAlgorithms=SSLv3, RC4, DH keySize < 768, SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA

Additional Information

 

* CA Broadcom Is not responsible for third party content