Detections
Analytics
SSL/TLS Services Support RC4 (PCI DSS)
medium Nessus Plugin ID 106458
Language:
Synopsis
A service on the remote host supports RC4Description
At least one of the SSL or TLS services on the remote host supports the use of RC4 for encryption.RC4 does not meet the PCI definition of strong cryptography as defined by NIST Special Publication 800-57 Part 1.
The RC4 cipher is flawed in its generation of a pseudo-random stream of bytes so that a wide variety of small biases are introduced into the stream, decreasing its randomness. If plaintext is repeatedly encrypted (e.g., HTTP cookies), and an attacker is able to obtain many (i.e., tens of millions) ciphertexts, the attacker may be able to derive the plaintext.
Solution
Consult the software's manual and reconfigure the service to disable support for RC4.See Also
https://blog.pcisecuritystandards.org/migrating-from-ssl-and-early-tls
Plugin Details
Severity: Medium
ID: 106458
File Name: pci_rc4_supported.nasl
Version: 1.6
Type: remote
Family: General
Published: 1/29/2018
Updated: 4/27/2020
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 4.4
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.2
Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N
CVSS Score Source: CVE-2015-2808
CVSS v3
Risk Factor: Medium
Base Score: 5.9
Temporal Score: 5.2
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Required KB Items: Settings/PCI_DSS
Excluded KB Items: Settings/PCI_DSS_local_checks
Exploit Ease: No known exploits are available
Reference Information
CVE: CVE-2013-2566, CVE-2015-2808