The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

PCI compliance test passes on port 443, but fails on ports 2087, 2083, 2096 and 2078

Discussion in 'Security' started by MacPhotoBiker, Apr 28, 2014.

  1. MacPhotoBiker

    MacPhotoBiker Registered

    Joined:
    Apr 28, 2014
    Messages:
    2
    Likes Received:
    0
    Trophy Points:
    1
    cPanel Access Level:
    Reseller Owner
    Hi,

    I'm trying to get my server PCI compliant, and I'm using this scanner:

    Check PCI DSS compliance - Online free pci dss compliance checker

    Port 443 passes the test just fine:
    "SSlv2 disabled. SSL Server won't allow Anonymous Authentication Vulnerability."

    However, on ports 2087, 2083, 2096 and 2078 I receive the following error message:

    SSL Server Allows Anonymous Authentication Vulnerability. A vulnerability exists in SSL communications when clients are allowed to connect using no authentication algorithm. An attacker can exploit this vulnerability to impersonate your server to clients.Please disable support for anonymous authentication.

    Could you help me out to solve these issues?

    Thanks a lot!
     
    #1 MacPhotoBiker, Apr 28, 2014
  2. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    35,580
    Likes Received:
    1,127
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Hello :)

    Are you able to use an alternate PCI scan that lists specific reasons for test failures? For instance, I do not see any references to specific CVE reports or specific attack vectors. Here is a third-party URL to an alternate PCI scan that describes how to manually check if anonymous authentication is possible:

    https://community.qualys.com/docs/DOC-1097

    Thank you.
     
    #2 cPanelMichael, Apr 29, 2014
  3. MacPhotoBiker

    MacPhotoBiker Registered

    Joined:
    Apr 28, 2014
    Messages:
    2
    Likes Received:
    0
    Trophy Points:
    1
    cPanel Access Level:
    Reseller Owner
    Hi Michael,

    thanks for pointing out that I should rather a different scanner :)

    I just did, and I received the following two vulnerabilities:

    1) rsh Service Detection rsh (8889/tcp)
    CVE-1999-0651

    2)OpenSSH < 5.7 Multiple Vulnerabilities ssh (2516/tcp)
    CVE-2010-4478, CVE-2012-0814

    I'm running a VPS on Centos 6.5.

    Couldyou guide me in the right direction to solve these issues?

    Thanks a lot!
     
    #3 MacPhotoBiker, Apr 29, 2014
  4. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    35,580
    Likes Received:
    1,127
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Hello :)

    It's likely reporting false positives based on the version number in cases where patches have been backported, or in cases where it does not effect the version shipped with your OS. RSH is not a standard package so you could remove it using your system package manager (YUM) if you have no specific requirement for it. CentOS 6 should not be effected by the OpenSSH CVE reports referenced:

    https://access.redhat.com/security/cve/CVE-2012-0814
    https://access.redhat.com/security/cve/CVE-2010-4478

    In both cases it states:

    Not vulnerable. This issue did not affect the versions of openssh as shipped with Red Hat Enterprise Linux 4, 5, or 6.

    Thank you.
     
    #4 cPanelMichael, May 2, 2014
(You must log in or sign up to post here.)
Loading...
Similar Threads - compliance test passes
  1. Serra

    PCI Compliance for Passive FTP Ports

    Serra, Jun 30, 2016, in forum: Security
    Replies:
    2
    Views:
    540
    cPanelMichael
    Jul 10, 2016
  2. santrix

    Security Metrics refuse cPanel PCI Compliance

    santrix, Mar 10, 2016, in forum: Security
    Replies:
    4
    Views:
    745
    santrix
    Mar 11, 2016
  3. PromptDev

    PCI Compliance - TLS 1.0 Protocol Detection

    PromptDev, Oct 26, 2015, in forum: Security
    Replies:
    6
    Views:
    1,158
    cPanelMichael
    Nov 10, 2015
  4. albatroz

    black, gray and white box security testing tools for web application testing

    albatroz, Jun 12, 2017, in forum: Security
    Replies:
    1
    Views:
    42
    cPanelMichael
    Jun 13, 2017
  5. hayridumanli

    /usr/bin/test -e /etc/cpanel-dovecot-solrdisable messages

    hayridumanli, Jun 8, 2017, in forum: E-mail Discussions
    Replies:
    1
    Views:
    68
    Infopro
    Jun 8, 2017

Share This Page