The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

PCI compliance test passes on port 443, but fails on ports 2087, 2083, 2096 and 2078

Discussion in 'Security' started by MacPhotoBiker, Apr 28, 2014.

  1. MacPhotoBiker

    MacPhotoBiker Registered

    Joined:
    Apr 28, 2014
    Messages:
    2
    Likes Received:
    0
    Trophy Points:
    1
    cPanel Access Level:
    Reseller Owner
    Hi,

    I'm trying to get my server PCI compliant, and I'm using this scanner:

    Check PCI DSS compliance - Online free pci dss compliance checker

    Port 443 passes the test just fine:
    "SSlv2 disabled. SSL Server won't allow Anonymous Authentication Vulnerability."

    However, on ports 2087, 2083, 2096 and 2078 I receive the following error message:

    SSL Server Allows Anonymous Authentication Vulnerability. A vulnerability exists in SSL communications when clients are allowed to connect using no authentication algorithm. An attacker can exploit this vulnerability to impersonate your server to clients.Please disable support for anonymous authentication.

    Could you help me out to solve these issues?

    Thanks a lot!
     
  2. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    30,854
    Likes Received:
    675
    Trophy Points:
    113
    cPanel Access Level:
    Root Administrator
    Hello :)

    Are you able to use an alternate PCI scan that lists specific reasons for test failures? For instance, I do not see any references to specific CVE reports or specific attack vectors. Here is a third-party URL to an alternate PCI scan that describes how to manually check if anonymous authentication is possible:

    https://community.qualys.com/docs/DOC-1097

    Thank you.
     
  3. MacPhotoBiker

    MacPhotoBiker Registered

    Joined:
    Apr 28, 2014
    Messages:
    2
    Likes Received:
    0
    Trophy Points:
    1
    cPanel Access Level:
    Reseller Owner
    Hi Michael,

    thanks for pointing out that I should rather a different scanner :)

    I just did, and I received the following two vulnerabilities:

    1) rsh Service Detection rsh (8889/tcp)
    CVE-1999-0651

    2)OpenSSH < 5.7 Multiple Vulnerabilities ssh (2516/tcp)
    CVE-2010-4478, CVE-2012-0814

    I'm running a VPS on Centos 6.5.

    Couldyou guide me in the right direction to solve these issues?

    Thanks a lot!
     
  4. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    30,854
    Likes Received:
    675
    Trophy Points:
    113
    cPanel Access Level:
    Root Administrator
    Hello :)

    It's likely reporting false positives based on the version number in cases where patches have been backported, or in cases where it does not effect the version shipped with your OS. RSH is not a standard package so you could remove it using your system package manager (YUM) if you have no specific requirement for it. CentOS 6 should not be effected by the OpenSSH CVE reports referenced:

    https://access.redhat.com/security/cve/CVE-2012-0814
    https://access.redhat.com/security/cve/CVE-2010-4478

    In both cases it states:

    Not vulnerable. This issue did not affect the versions of openssh as shipped with Red Hat Enterprise Linux 4, 5, or 6.

    Thank you.
     
Loading...

Share This Page