2

There have been a large number of SSL/TLS vulnerabilities over the last several years. It is quite hard to find current information about which of these are still relevant and require practical mitigation at the server-side and which have been superseded by things like client-side updates.

Which of these issues is still a problem requiring mitigation at the server-side in 2016?

  • BEAST
  • BREACH
  • CRIME
  • DROWN
  • Logjam
  • POODLE
  • FREAK
  • Heartbleed
  • CCS Injection

For example per https://blog.qualys.com/ssllabs/2013/09/10/is-beast-still-a-threat it appears that BEAST no longer requires server side mitigation, as it has client-side mitigation.

  • It depends on your systems and the dependencies of your applications. All are still relevant as they still exist and can be utilized on the right system. – user987654321 Mar 29 '16 at 17:08
  • err no. e.g. blog.qualys.com/ssllabs/2013/09/10/is-beast-still-a-threat which states that server-side mitigation for BEAST is no longer needed. The point of the question was to establish which still require server-side mitgation as not all do. – A_Learner Mar 29 '16 at 19:29
  • The argument from your link was that it is not an issue because the vulnerability was conducted through the client-side. In best practice, you would still want to make sure to mitigate on your end. – user987654321 Mar 29 '16 at 19:34
  • sorry perhaps my question was unclear, I was looking to see which issues still practically required mitigation server-side and which could be ignored as they had been resolved elsewhere, I'll update the question to make that clearer. – A_Learner Mar 29 '16 at 19:36
  • @user987654321 You certainly do not want to mitigate BEAST on the server-side. It requires enabled (and choosing) RC4 in all versions of TLS < 1.2, which is a significantly worse option then ignoring BEAST. – Xander Mar 29 '16 at 20:51
1

I think all these flaws are fixed in the latest version of TLS. As the other answer says, you can be vulnerable to some of them depending on the versions your software allows. If you are concerned about this, you should search for each one to see in which version they have been fixed, and configure your server accordingly.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.