Fixing an OpenSSL vulnerability at the firewall

Question

We did a Qualys test on two of our URLs earlier today. The URLs are of two similar applications (same versions) hosted on identical servers located at two different datacenters. The test returned 'A-' for one and 'F' for the other. The reason for 'F' rating was given as:

This server is vulnerable to the OpenSSL Padding Oracle vulnerability (CVE-2016-2107) and insecure. Grade set to F.

However, the version of OpenSSL we have on both the servers are old and identical:

[user@alpha01 ~]$ rpm -qa | grep openssl
openssl-1.0.1e-30.el6_6.4.x86_64

Why did the Qualys test not identify the vulnerability on the server that it gave 'A-' though it is running a vulnerable version of OpenSSL as the other? Is OpenSSL Padding Oracle vulnerability something that can be fixed at the firewall level? I suspect the firewall at the server that received the 'A-' was successful in filtering out the packet that was trying to test this vulnerability. Am I right? Is this something that can be fixed at the firewall level? (Since both the webservers are located at different data-centers and behind different firewalls)

Answer 1

Is OpenSSL Padding Oracle vulnerability something that can be fixed at the firewall level? I suspect the firewall at the server that received the 'A-' was successful in filtering out the packet that was trying to test this vulnerability. Am I right? Is this something that can be fixed at the firewall level?

No. SSL/TLS protocols have anti-tampering protections; if, for example, the firewall were to alter any of the handshake, the handshake would fail because both sides validate that what they sent was what got seen by the other side.

Other configurations might protect you. If you had a SSL offloader or man-in-the-middle proxy, something which terminated and then re-opened connections so that you have connections #1 and #2:

[Server]<---1--->[Proxy]<---2--->[Scanner]

Then that would do it, because the vulnerable SSL library on Server isn't being touched by the scanner.

However, the version of OpenSSL we have on both the servers are old and identical:

[user@alpha01 ~]$ rpm -qa | grep openssl
openssl-1.0.1e-30.el6_6.4.x86_64

And old. That version is superseded by openssl-1.0.1e-48.el6_8.4.x86_64.rpm. I would recommend updating it in both places and seeing if that makes it go away. Restart your services after updating, of course.

---

Notice that I haven't really addressed the root question of "Why do two servers with the same libraries give different results." That's because there's not really enough information to tell. Are the server daemons the same on both hosts? Could one be using different SSL libraries? Did the scanner exercise the same level of testing against both? How many times have you scanned each host? Are the results solidly consistent?

With all that unknown, and given that you're running a known deprecated version of OpenSSL, my recommendation is to patch and test again.