Vulnerabilities found on DX NetOps Spectrum 21.2

Products

• CA Spectrum
• DX NetOps

Issue/Introduction

Vulnerability scan on DX NetOps Spectrum 21.2 found multiple vulnerabilities such as the following:

Plugin	Plugin Name	Severity	Component	Port	CVE
12085	Apache Tomcat Default Files	Medium	OneClick	9443
142960	HSTS Missing From HTTPS Server (RFC 6797)	Medium	OneClick	9443
151969	MySQL 5.7.x < 5.7.35 Multiple Vulnerabilities (Jul 2021 CPU)	High	OneClick	0	CVE-2019-17543, CVE-2021-2342, CVE-2021-2356, CVE-2021-2372, CVE-2021-2385, CVE-2021-2389, CVE-2021-2390, CVE-2021-22901
152182	Apache Tomcat 9.0.0.M1 < 9.0.48 vulnerability	Medium	OneClick	9443	CVE-2021-33037
151969	MySQL 5.7.x < 5.7.35 Multiple Vulnerabilities (Jul 2021 CPU)	High	MLS SpectroSERVER (SS)	0	CVE-2019-17543, CVE-2021-2342, CVE-2021-2356, CVE-2021-2372, CVE-2021-2385, CVE-2021-2389, CVE-2021-2390, CVE-2021-22901
151969	MySQL 5.7.x < 5.7.35 Multiple Vulnerabilities (Jul 2021 CPU)	High	MLS-Fault-Tolerant SS	0	CVE-2019-17543, CVE-2021-2342, CVE-2021-2356, CVE-2021-2372, CVE-2021-2385, CVE-2021-2389, CVE-2021-2390, CVE-2021-22901
104743	TLS Version 1.0 Protocol Detection	Medium	Jasper Server CABI	443

How have these been addressed?

Environment

DX NetOps 21.2.x Spectrum

Resolution

  1. Apache Tomcat Default Files on port 9443(for webtomcat) : 

     Solution : Add the following in the webtomcat/conf/server.xml file, under Engine tag after AccessLogValue.

 <Valve className="org.apache.catalina.valves.ErrorReportValve" showReport="true" showServerInfo="false"></Valve>

 

  2. HSTS Missing From HTTPS Server (RFC 6797) on port 9443(for webtomcat):

   Solution : It should ideally be fixed as we have already added HttpHeaderSecurity filter in $Webtomcat/conf/web.xml file. Please cross check this file and see if this section is available in this web.xml file:

   <filter>
        <filter-name>httpHeaderSecurity</filter-name>
        <filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</filter-class>
        <init-param>
            <param-name>antiClickJackingOption</param-name>
            <param-value>SAMEORIGIN</param-value>
        </init-param>
        <async-supported>true</async-supported>
    </filter>

    

     At some down side in the same web.xml file this section should also be available/uncommented :

     <filter-mapping>
        <filter-name>httpHeaderSecurity</filter-name>
        <url-pattern>/*</url-pattern>
        <dispatcher>REQUEST</dispatcher>
    </filter-mapping>

   

 

  3. MySQL 5.7.x < 5.7.35 Multiple Vulnerabilities (Jul 2021 CPU)

   Solution : My SQL has been upgraded to 5.7.35 in Spectrum 21.2.2.0

 

  4. Apache Tomcat 9.0.0.M1 < 9.0.48 vulnerability:

  Solution : Tomcat has been upgraded to 9.0.50 in Spectrum 21.2.2.0.

 

  5. MySQL 5.7.x < 5.7.35 Multiple Vulnerabilities (Jul 2021 CPU)

   Solution : My SQL has been upgraded to 5.7.35 in Spectrum 21.2.2.0

 

  6. MySQL 5.7.x < 5.7.35 Multiple Vulnerabilities (Jul 2021 CPU)

   Solution : My SQL has been upgraded to 5.7.35 in Spectrum 21.2.2.0

 

  7. TLS Version 1.0 Protocol Detection

   Solution : 

Edit the file $SPECROOT\tomcat\webapps\spectrum\META-INF\context.xml in the customer environment

 Replace

vbroker.security.client.socket.enabledProtocols=TLSv1.2,TLSv1 vbroker.security.server.socket.enabledProtocols=TLSv1.2,TLSv1

with

vbroker.security.client.socket.enabledProtocols=TLSv1.2 vbroker.security.server.socket.enabledProtocols=TLSv1.2

 and rescan check if this solves the TLSv1.0 issue?

They can also try the below change as well when Mod-Security is enabled:

Edit httpd-ssl.conf file and search for “SSLProtocol all” and please edit this line to disable TLSv1 and TLSv1.1 protocols.

          For Example :

               SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1       // "-" sign indicates all except these protocols.

SSLProxyProtocol all -SSLv3 -TLSv1 -TLSv1.1

Also ask them to disable weak ciphers by editing the SSLCipherSuite and SSLProxyCipherSuite lines like this:

SSLCipherSuite HIGH:MEDIUM:!MD5:!RC4:!3DES:!DES:!IDEA:!SSLv3:!kRSA

SSLProxyCipherSuite HIGH:MEDIUM:!MD5:!RC4:!3DES:!DES:!IDEA:!SSLv3:!kRSA

Additional Information

To verify the response has the Strict Transport Security Header added:

- Open a new Chrome Browser

- Click on the three dots in the upper right corner of the browser and select More Tools -> Developer tools from the menu

- Enter the url for access to the WebApp login. For example, https://192.168.2.1:8443/spectrum/webapp where 8443 is the https port for Spectrum tomcat not WebTomcat:

- In the Developer Tools window, click on Networking  and All

- In the Name column, click on the first login entry

- Click on the Headers tab

- Scroll down and look for the following:

Strict-Transport-Security: max-age=0
Strict-Transport-Security: max-age=6307200; includeSubDomains; preload