Dx NetOps Spectrum : Multiple SSL Vulnerability issue

Products

• CA Spectrum

Issue/Introduction

Following are the multiple Vulnerability 's has been reported.

Vulnerability Name	Severity	Types of Scan
SSL Server Supports Weak Encryption Vulnerability	Medium	HDC_PROD
SSL Server May Be Forced to Use Weak Encryption Vulnerability	Medium	HDC_PROD
SSL Server Allows Anonymous Authentication Vulnerability	Medium	HDC_PROD
SSL Server Allows Cleartext Communication Vulnerability	Medium	HDC_PROD
SSL/TLS Server supports TLSv1.0	Medium	HDC_PROD

There are 5 SSL related Vulnerability has been reported.

Environment

Release : 10.4

Component : Spectrum Core / SpectroSERVER

Resolution

1. Enable ModSecurity and rescan the application. If the vulnerabilities are still found then follow the step-2 below:

https://techdocs.broadcom.com/us/en/ca-enterprise-software/it-operations-management/spectrum/10-4-2/administrating/oneclick-administration/oneclick-server-communications-and-network-configuration/enable-modsecurity-web-application-firewall.html

2. Go to $SPECROOT/tomcat/webapps folder, look for these folders : docs, examples, host-manager, manager, ROOT. Backup these folders and delete them from webapps directory. Rescan and see.

The only impact with deleting the ROOT folder under tomcat/webapps is that the default redirecting to /spectrum will not work. Let me explain you in detail:

Currently when you hit the OC Webserver by just giving the hostname (http://:) it redirects to the /spectrum url (http://:/spectrum) for login page or Administration page. This redirection is being done in index.html file present under ROOT directory. So, if the ROOT directory is removed then this redirection may fail. They can keep the ROOT directory with only index.html and favicon.ico files and rest all can be deleted without any issues.

 

Note : If these vulnerabilities are found on the CORBA ports(as per expectation), then these have been fixed in 21.2.1.0 with the introduction of Secure CORBA feature.