NMAP vulnerability testing performed on a server running the Symantec Endpoint Protection Manager (SEPM) may throw an alert for use of a weak CBC cipher. To address this alert, and to mitigate against possible exploitation attacks against the weak cipher it becomes necessary to disable the weak CBC cipher on the SEPM server.
Vulnerable cipher which may need to be disabled by some organizations to comply with vulnerability scanning requirements
To disable CBC for client communications and SEPM Reporting functions, please make the following changes:
1) Create backups first, then edit the ssl.conf and sslForClients.conf files within the following path:
\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\apache\conf\ssl
2) Locate the following lines - the same lines will be found in both files:
SSLCipherSuite HIGH:!MEDIUM:!LOW:!aNULL:!eNULL:!3DES:!RC4:!kDH:!SHA1
3) At the end of line add: ":!SHA256:!SHA384" without double quotes. ( both the files )
SSLCipherSuite HIGH:!MEDIUM:!LOW:!aNULL:!eNULL:!3DES:!RC4:!kDH:!SHA1:!SHA256:!SHA384
4) Save the changes made to each file.
5) Reboot the SEPM server or restart the Symantec Endpoint Protection Manager and Symantec Endpoint Protection Manager Webserver services.
To disable CBC for internal SEPM server communications and web services:
To disable the specific CBC and RSA:
To achieve this, you can convert them to the equivalent cipher suite keywords in OpenSSL:
Example: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,TLS_DHE_RSA_WITH_AES_256_CCM_8,TLS_DHE_RSA_WITH_AES_256_CCM,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,TLS_DHE_RSA_WITH_AES_128_CCM_8,TaLS_DHE_RSA_WITH_AES_128_CCM
Note: The value keywords may change based on the requirement.
Note: The original list of cipher suites was created for compatibility and includes less secure options but remains challenging to exploit. After replacing the list with a more secure one, you must ensure that communication via 8446 (SEPM API) continues functioning correctly.
NMAP test scan can be done for the ports in question through command line: -
C:\Users\Administrator>nmap --script ssl-enum-ciphers -p 8443 xx.xx.xx.xx