{"id":252,"date":"2012-12-22T16:38:27","date_gmt":"2012-12-22T21:38:27","guid":{"rendered":"http:\/\/www.amixa.com\/blog\/?p=252"},"modified":"2012-12-22T16:41:58","modified_gmt":"2012-12-22T21:41:58","slug":"how-to-get-iis-7-5-web-server-to-pass-the-beast-pci-vulnerability-compliance-scans","status":"publish","type":"post","link":"http:\/\/www.amixa.com\/blog\/2012\/12\/22\/how-to-get-iis-7-5-web-server-to-pass-the-beast-pci-vulnerability-compliance-scans\/","title":{"rendered":"How to get IIS 7.5 web server to pass the BEAST PCI vulnerability compliance scans"},"content":{"rendered":"

If your e-commerce website keeps flunking PCI vulnerability complaince scans with the following error:<\/p>\n

BEAST (Browser Exploit Against SSL\/TLS) Vulnerability, CVE-2011-3389<\/strong><\/p>\n

and you are running Microsoft Server 2008 R2, I can help you.<\/p>\n

If you aren’t on Windows Server 2008 R2, there is no known way to pass this test short of upgrading your server to W2K8R2 and doing the following steps<\/span>.<\/p>\n

This is the exact vulnerability as reported (in our case, by Trustkeeper):<\/p>\n

BEAST (Browser Exploit Against SSL\/TLS) Vulnerability The SSL protocol encrypts data by using CBC mode with chained initialization vectors. This allows an attacker, which is has gotten access to an HTTPS session via man-in-the-middle (MITM) attacks or other means, to obtain plain text HTTP headers via a blockwise chosen-boundary attack (BCBA) in conjunction with Javascript code that uses the HTML5 WebSocket API, the Java URLConnection API, or the Silverlight WebClient API. This vulnerability is more commonly referred to as Browser Exploit Against SSL\/TLS or “BEAST”.<\/strong><\/p>\n

CVE: CVE-2011-3389 <\/strong><\/p>\n

NVD: CVE-2011-3389 <\/strong><\/p>\n

Bugtraq: 49778 <\/strong><\/p>\n

CVSSv2: AV:N\/AC:M\/Au:N\/C:P\/I:N\/A:N(4.30)<\/strong><\/p>\n

This is the remediation (as stated by Trustkeeper):<\/p>\n

Affected users should disable all block-based cipher suites in the server’s SSL configuration and only support RC4 ciphers, which are not vulnerable to fully address this vulnerability. This vulnerability was addressed in TLS version 1.1\/1.2, however, support for these newer TLS versions is not widely supported at the time of this writing, making it difficult to disable earlier versions.<\/strong><\/p>\n

Additionally, affected users can also configure SSL to prefer RC4 ciphers over block-based ciphers to limit, but not eliminate, exposure. Affected users that implement prioritization techniques for mitigation as described above should appeal this vulnerability and include details of the SSL configuration.<\/strong><\/p>\n

Here is the evidence (as stated by TrustKeeper):<\/p>\n

Service: http<\/strong>
\nEvidence:<\/strong>
\nCipher Suite: SSLv3 : DES-CBC3-SHA<\/strong>
\nCipher Suite: SSLv3 : RC4-SHA<\/strong>
\nCipher Suite: SSLv3 : RC4-MD5<\/strong>
\nCipher Suite: TLSv1 : AES256-SHA<\/strong>
\nCipher Suite: TLSv1 : AES128-SHA<\/strong>
\nCipher Suite: TLSv1 : DES-CBC3-SHA<\/strong>
\nCipher Suite: TLSv1 : RC4-SHA<\/strong>
\nCipher Suite: TLSv1 : RC4-MD5<\/strong><\/p>\n

That isn’t much help, of course.<\/p>\n

Ok, here is how to solve this.\u00a0 And you don’t even need REGEDIT!<\/p>\n

    \n
  1. Make sure your website is on a Windows 2008 R2 server, with a valid SSL certificate.<\/li>\n
  2. Download the following FREE – and FANTASTIC\u00a0program to your web server.\n
      \n
    1. https:\/\/www.nartac.com\/Products\/IISCrypto\/Default.aspx<\/a><\/li>\n<\/ol>\n<\/li>\n
    2. Run the program on your web server.\u00a0 Please be logged in as full admin, and remote desktop is fine.<\/li>\n
    3. Start by clicking the PCI button, then make all your settings look like below:\n
        \n
      1. \"pci\"<\/li>\n<\/ol>\n<\/li>\n
      2. In some cases you might have a few more listing under SSL Cipher Suite order.\u00a0 Here is a screenshot from a second server (below).\u00a0 The settings below are also perfectly fine:\n
          \n
        1. \"pci2\"<\/li>\n<\/ol>\n<\/li>\n
        2. In all cases – MAKE YOUR SETTINGS JUST LIKE ABOVE<\/strong><\/span> – and your site should always pass the BEAST test.\n
            \n
          1. IT IS CRITICAL that you have ONLY the CIPHERS selected in the above two screenshots, and the TOPMOST TWO in THIS SPECIFIC ORDER.<\/strong><\/span><\/li>\n<\/ol>\n<\/li>\n
          2. apply the changes<\/li>\n
          3. Restart the server.<\/li>\n
          4. once the server is back up and running, go to the website below:\n
              \n
            1. https:\/\/www.ssllabs.com\/ssltest\/index.html<\/a><\/li>\n<\/ol>\n<\/li>\n
            2. Allow the test to complete.\u00a0 The test will tell you if the site passes all the tests and is BEAST compliant, and it will give you a score for your website.\u00a0 The website we tested scored 89 which is an “A”.<\/li>\n<\/ol>\n

              Hopefully this will help shortcut this process for some of you. I literally spent hours working this solution out.<\/p>\n

               <\/p>\n

               <\/p>\n","protected":false},"excerpt":{"rendered":"

              If your e-commerce website keeps flunking PCI vulnerability complaince scans with the following error: BEAST (Browser Exploit Against SSL\/TLS) Vulnerability, CVE-2011-3389 and you are running Microsoft Server 2008 R2, I can help you. If you aren’t on Windows Server 2008 R2, there is no known way to pass this test short of upgrading your server to W2K8R2 and doing the<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4,22],"tags":[5,71,9],"class_list":["post-252","post","type-post","status-publish","format-standard","hentry","category-iis-tips-n-tricks","category-windows-server","tag-iis","tag-pci-vulnerability-compliance","tag-trustkeeper-scan"],"_links":{"self":[{"href":"http:\/\/www.amixa.com\/blog\/wp-json\/wp\/v2\/posts\/252","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.amixa.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.amixa.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.amixa.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"http:\/\/www.amixa.com\/blog\/wp-json\/wp\/v2\/comments?post=252"}],"version-history":[{"count":5,"href":"http:\/\/www.amixa.com\/blog\/wp-json\/wp\/v2\/posts\/252\/revisions"}],"predecessor-version":[{"id":259,"href":"http:\/\/www.amixa.com\/blog\/wp-json\/wp\/v2\/posts\/252\/revisions\/259"}],"wp:attachment":[{"href":"http:\/\/www.amixa.com\/blog\/wp-json\/wp\/v2\/media?parent=252"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.amixa.com\/blog\/wp-json\/wp\/v2\/categories?post=252"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.amixa.com\/blog\/wp-json\/wp\/v2\/tags?post=252"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}