1

Hi We have a Windows 2008R2 SP1 server system running Oacle with OpenSSL. Upon doing a security scan we have found out that we are getting: OpenSSL oracle padding vulnerability(CVE-2016-2107) vulnerability.

Threat: A MITM attacker can use a padding oracle attack to decrypt traffic. Impact: A MITM attacker can use a padding oracle attack to decrypt traffic when the connection uses an AES CBC cipher and the server support AES-NI.

What steps on the Windows side can we take to remediate this issue?

2

A 'padding oracle attack' has nothing to do with the Oracle database software.

Ensure windows is updated, and remove the insecure cipher suites that this machine was configured to use.

  • So this vulnerability isn't related to OpenSSL and is OS related? (Windows in this case?) – gsb005 Nov 4 '16 at 17:02
  • 1
    @gsb005 all implementations of TLS that use these insecure cipher suites are affected. SSL/TLS misconfigurations are common because people just assume that software is 'secure' out of the box. – rook Nov 4 '16 at 22:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.