DevTest 10.7.2 (Kenna Vulnerability) reported.

Products

• Service Virtualization

Issue/Introduction

Reported the below Kenna Vulnerability.  

Diagnosis: The remote host allows SSL/TLS connections with one or more Diffie-Hellman moduli less than or equal to 1024 bits. Through cryptanalysis, a third party may be able to find the shared secret in a short amount of time (depending on modulus size and attacker resources). This may allow an attacker to recover the plaintext or potentially violate the integrity of connections.

 

 

Environment

DevTest 10.7.2

Cause

Vulnerability.

Resolution

Solution: Reconfigure the service to use a unique Diffie-Hellman moduli of 2048 bits or greater.

In the DEVTEST_HOME/jre/lib/security/java.security file:

Disable this line:

jdk.tls.disabledAlgorithms=SSLv3, TLSv1, TLSv1.1, RC4, DES, MD5withRSA, \
    DH keySize < 1024, EC keySize < 224, 3DES_EDE_CBC, anon, NULL, \
  

Then add these two lines.  jdk.tls.client.protocols is a new property and jdk.tls.disabledAlgorithms replaces the above with a new value.

jdk.tls.client.protocols=TLSv1.2 
jdk.tls.disabledAlgorithms=TLSv1, MD5, SSLv3, DSA, DESede, DES, RSA keySize < 2048, \
    EC keySize < 224, 3DES_EDE_CBC, anon, NULL

Restart the services.  This should be done on each DevTest machine, including Workstations.