VCLD-70-000026 - VAMI must disable client-initiated Transport Layer Security (TLS) renegotiation.

Information

All versions of the Secure Sockets Layer (SSL) and TLS protocols (up to and including TLS 1.2) are vulnerable to a man-in-the-middle attack (CVE-2009-3555) during a renegotiation. This vulnerability allows an attacker to 'prefix' a chosen plaintext to the HTTP request as seen by the web server. The protocols have since been amended by RFC 5746, but the fix must be supported by both client and server to be effective.

While Lighttpd and the underlying OpenSSL libraries are no longer vulnerable, steps must be taken to account for older clients that do not support RFC 5746. To this end, Lighttpd disables client-initiated renegotiation entirely by default. This configuration must be validated and maintained.

Solution

Navigate to and open:

/opt/vmware/etc/lighttpd/lighttpd.conf

Remove any setting for 'ssl.disable-client-renegotiation'.

Restart the service with the following command:

# vmon-cli --restart applmgmt

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMW_vSphere_7-0_Y23M07_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-256670r888532_rule, STIG-ID|VCLD-70-000026, Vuln-ID|V-256670

Plugin: Unix

Control ID: 071f1fa219d4b77c24bcb852fc54269874b74cd4a87f00b1a59f68f3d1a9832d