Posted by:
admin
11 years, 4 months ago
Wow, when will it stop?
Luckily, this one is not too bad. Please read Errata Security's review of the bug for background. The risk is a Man-in-the-middle attack against your WiKIDAdmin login. Since your WiKIDAdmin should be locked down to the inside of your firewall this should be a difficult attack. You should disable SSLv3 on your browser as that will protect you at all sites, not just the WiKIDAdmin. We will be disabling SSLv3 in the WiKIDAdmin soon, but we don't see this as a major risk at this time. If you want to disable SSLv3 right now you can edit /opt/WiKID/tomcat/conf/server.xml and change the Connector information for 443 to this:
<Connector port="443" protocol="HTTP/1.1" SSLEnabled="true"
maxThreads="150" scheme="https" secure="true" sslEnabledProtocols="TLSv1, TLSv1.2"
ciphers="TLS_RSA_WITH_AES_128_CBC_SHA"
keystorePass="passphrase" keystoreFile="/opt/WiKID/conf/tomcatKeystore"
clientAuth="false" sslProtocol="TLS" />
And restart the WiKID service. This will allow only TLSv1 and 1.2 for tomcat. Note once again the the software tokens use public-private key pairs for the PIN and OTP exchange so they do not use SSL! This only affects the WiKIDAdmin interface. The wAuth protocol uses client-side certificates and is not affected either.
Also, note the benefit of using two-factor authentication. While a successful MiTM can get any information, grabbing credentials allows you to login any time. If you are not using two-factor auth, give the WiKID server a spin!
Share on Twitter Share on Facebook