Integrity Servers
1748169 Members
3677 Online
108758 Solutions
New Discussion

Re: Security Vulnerability: SSL Version 2 and 3 Protocol Detection

 
f. halili
Trusted Contributor

Security Vulnerability: SSL Version 2 and 3 Protocol Detection

Our 3rd party vulnerability scanner found SSL v2 and SSL v3 in our HP-UX 11..31  systems and flagged them as medium vulnerability. 

How do you diable SSL v2 or SSL v3 in HP-UX? Is there a way to check if they are even used?

Thanks!

 

derekh
1 REPLY 1
MK_J
HPE Pro

Re: Security Vulnerability: SSL Version 2 and 3 Protocol Detection

It would have helped if you had shared CVE ID of the vulnerability. There is a chance that a fix is already there.

Please note, it is required to disable old ssl protocol in individual application, most of the time its a web server.
Also note that SSLv3 protocol has already been disabled in latest HPE SMH product.

However, you can enable or disable SSL protocols by listing all the protocols with ‘+’ to enable and ‘-’ to disable, separated by semicolon.
For example:
smhconfig –H -SSLv2;-SSLv3;+TLSv1;+TLSv1.1;+TLSv1.2
Where, SSLv2 and SSLv3 are disabled and TLSv1, TLSv1.1,TLSv1.2 are enabled.

For more detailed analysis, please open a case with HPE support as it requires verifying installed prodcts and patches in the server.

Regards !


I work for HPE

Accept or Kudo