Reconfigure the service to use a unique Diffie-Hellman moduli of 2048 bits or greater.

LittleMaster · 12-26-2017, 11:51 PM

Hi All,

I have scanned my server with Symantec network scan and I've got below alert message

I've made google search but unable to point out to exact solutions to fix the vulnerability

Any help regarding this vulnerability will be very helpful

Thanks in advance

Solutions:
Reconfigure the service to use a unique Diffie-Hellman moduli of 2048 bits or greater.

Vulnerable connection combinations :

SSL/TLS version : TLSv1.1
Cipher suite : TLS1_CK_DHE_RSA_WITH_AES_128_CBC_SHA
Diffie-Hellman MODP size (bits) : 1024
Warning - This is a known static Oakley Group2 modulus. This may make
the remote host more vulnerable to the Logjam attack.
Logjam attack difficulty : Hard (would require nation-state resources)

SSL/TLS version : TLSv1.0
Cipher suite : TLS1_CK_DHE_RSA_WITH_AES_128_CBC_SHA
Diffie-Hellman MODP size (bits) : 1024
Warning - This is a known static Oakley Group2 modulus. This may make
the remote host more vulnerable to the Logjam attack.
Logjam attack difficulty : Hard (would require nation-state resources)

Reconfigure the service to use a unique Diffie-Hellman moduli of 2048 bits or greater.

bathory · 12-27-2017, 09:39 AM

Hi,

You didn't say what service you're scanning against the logjam vulnerability, but you should also ditch TLSv1.0 and TLSv1.1 and use only TLSv1.2

As for your question, take a look here

Regards