0

We have several Windows 2008 and 2012 servers which are showing the, "SSL Server Allows Anonymous Authentication Vulnerability"

What is the best way to remediate this vulnerability without affecting clients.

Thanks.

1

The issue of Anonymous Authentication in SSL means that the server is accepting ciphers which don't require authentication of the server. This authentication is usually done by checking the servers certificate. Using a cipher with anonymous authentication means that no authentication of the server will be done inside the TLS handshake and thus the connection is open for man in the middle attacks.

It is unknown which kind of clients you have. But if you have just browsers as clients then you could simply disable anonymous authentication in the server since browsers don't use these ciphers anyway.

For any other clients you would actually have a look at the specific client and if it uses anonymous authentication. But most clients will also not use anonymous authentication by default so the chances are high that no client will be affected when switching these insecure ciphers off.

  • can you elaborate on the last part of your answer? you mean to weak cyphers? for example: DES 56/56 RC2 40/128 RC2 56/128 RC2 128/128 – gsb005 Oct 31 '16 at 20:40
  • Any cipher you consider insecure. – Ramhound Nov 1 '16 at 2:10
  • @gsb005: these insecure ciphers I recommend to switch off are exactly these mentioned in the error message: ciphers with anonymous authentication like ADH. Such ciphers don't do authentication of the server by using a certificate so they are prone to man in the middle attacks. Given that you asked only for remediation in your question I was under the assumption that you already understood what the vulnerability means and only asked how to fix it without impacting existing clients. – Steffen Ullrich Nov 1 '16 at 4:41
  • can you also comment on whether disabling weak protocols like PCT 1.0, SSL 2.0, and SSL 3.0 will have an impact here. – gsb005 Nov 1 '16 at 13:02
  • 1
    @gsb005: Disabling these protocols does not have any impact on this issue but it might have impact on the clients. But this would be a different question then which also requires more information about your clients. – Steffen Ullrich Nov 1 '16 at 13:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.