POODLE SSLv3 Vulnerabilities Fixes on Debian/pfSense for common widely used apps

admin

Systems or apps that enabled SSLv3 is vulnerable and the only way currently is to disable SSLv3 in various software, applications. Whenever you see any cert that says Version V3, it is vulnerable and must be disabled until further notice.
Ref: CVE-2014-3566

IMPORTANT

  • USETHIS GUIDE AT YOUR OWN RISK, i am not responsible for any broken apps/programs etc etc.
  • We do not know the extent of the vulnerability/fixes this is from best knowledge and effort, you are advised to research of your own too and not completely rely on these below. These methods are also described in many many online articles, i put them together mainly for our customers and people using Deb6/7.
  • This article is to be done/performed by those who have sufficient knowledge in these apps/software
  • Please read more articles and follow online security resources for updates should there be any.
  • Until a patch is released, customers are advised to simply disable SSLv3 as part of an enforced or fallback method for providing encryption.

Software that we use/distribute 1) Apache
2) Asterisk
3) Nagios (and related software)
4) pfSense and related software (e.g. OpenVPN)
5) Other related software There are many guides out there and (i’ve) we have copied some of them for the ease of our clients

Apache fix

#nano /etc/apache2/mods-available/ssl.conf
Locate the value SSLProtocol, if it doesn’t exist, add exactly as below within the </ifmodule> tag
SLProtocol all -SSLv2 –SSLv3
if exist in that file, change as below
SLProtocol all -SSLv2 to  SLProtocol all -SSLv2 –SSLv3 Restart apache
#/etc/init.d/apache2 restart A simple test for apache would be to run
#openssl s_client -ssl3 -connect localhost:443 It should throw an error like handshake failure, that’s good!, SSLv3 is disabled on Apache!

Asterisk fix

Read stuff here: http://downloads.asterisk.org/pub/security/AST-2014-011.html For Asterisk 11 Go to your Asterisk 11 source directory
#cd /usr/src/asterisk-11…..
If don’t exist, just download from http://downloads.asterisk.org/pub/telephony/asterisk/. NOTE: Asterisk 11.13.1 fixes this so you don’t have to patch as below if you are redownloading.
#wget http://downloads.asterisk.org/pub/security/AST-2014-011-11.diff
#patch –p0 < AST-2014-011-11.diff

For recent installs (2013 onwards):
#make clean && ./configure –with-crypto –with-ssl –with-srtp=/usr/local/lib –prefix=/usr
#make && make install Older Installs simply run (Skip if the above worked!)
#make clean && ./configure For Asterisk 1.8 Go to your Asterisk 1.8 source directory
#cd /usr/src/asterisk-1.8…..
If don’t exist, just download from http://downloads.asterisk.org/pub/telephony/asterisk/. NOTE: Asterisk 1.8.31.1 fixes this, so you don’t have to patch as below if you are redownloading
#wget http://downloads.asterisk.org/pub/security/AST-2014-011-1.8.diff
#patch –p0 < AST-2014-011-1.8.diff
#make clean && ./configure –with-crypto –with-ssl –with-srtp=/usr/local/lib –prefix=/usr

Older Installs simply run (Skip if the above worked!)
#make clean && ./configure #make && make install

For both 1.8 and 11, restart Asterisk (FreePBX users!)
#amportal kill
#amportal start

Nagios fix

[Nagios info contributor: Anthony [at..]] Astiostech.com
Nagios itself as a monitoring system doesn’t use SSL in the monitoring core itself. With the POODLE SSLv3 Vulnerabilities in mind, so far Nagios itself is not vulnerable to the issue as the following explains. Nagios Console (Monitoring Core) Nagios Core monitoring engine doesnt use SSL in itself. It is only used by the Nagios Web Console or any Nagios Web Configuration Editor. These web consoles are very dependant on the running HTTP server in the system. Therefore the POODLE vulnerabilities on the CORE Nagios should be properly handled by the HTTP server itself. Nagios NRPE SSL option in NRPE is used to encrypt the monitoring data. When this is switched on Nagios NRPE encrypts the data between the Nagios Core and the remote server. According to the file ‘src/nrpe.c‘ line 256, since January 19th 2004, by default SSLv3 and SSLv2 has been disabled in NRPE and only TLS protocols are used. Therefore it is considered safe if the SSL is enabled in the NRPE agent. Nagios NDO2DB SSL option in NDO2DB is used to encrypt the received monitoring data from Nagios. When this is switched on Nagios NDO2DB encrypts the data between the Nagios Core and the NDO2DBserver. According to the file ‘src/ndo2db.c‘ in line 167, since January 19th 2004, by default SSLv3 and SSLv2 has been disabled in ndo2db and only TLS protocols are used. Therefore it is

pfSense fix

The webserver Go into the shell of pfsense, and run
#openssl s_client -connect localhost:443 -ssl3
If you see a value other than NONE in the cipher then its vulnerable and must be fixed. Using the WebUI, we will download and install the system patch manager
1) Goto System, go to Packages, click on Available Packages
2) Locate System Patches and add it/install it
3) Go back to System, click on Patches
4) Click on + to add new patch
5) If using 2.2x, enter this “5ff7f58e5903cca4f99edd20f9db402163527fd6” without quotes as the commit ID
6) If using 2.1x, enter “29be59ad8ed25830f4e50a89977aca53ad8a29f4” without quotes as the commit ID
7) Click on Save, then it will bring you out to the main page, click on Fetch. Wait for it to complete. Now, you should see the word test, click on test. Once you can test, it will tell you patch can be applied cleanly. If only so, click Apply. If not, you’ve done something wrong 🙁
8) Restart the webservice
9) Point your browser to /restart_httpd.php, say if your pfsense IP is https://10.10.10.1 then just point to https://10.10.10.1/restart_httpd.php
10) Run again
#openssl s_client -connect localhost:443 –ssl3
You should now get an error! The OpenVPN OpenVPN uses TLS so it is not vulnerable. OpenVPN uses TLSv1.0, or (with >=2.3.3) optionally TLSv1.2 and is thus not impacted by POODLE. [src pfsense forum]

Other software that uses SSLv3

If you are aware of any other encrypting software that may use SSLv3, you might need to search for documents online on how to disable SSLv3 within the app’s implementation. If you know of such app and need help from us, do contact us and we will have a look at it.