SSL/TLS Weaknesses Explained

What each weakness the SSL/TLS Server Test looks for actually is, why it matters, and how to fix it.

Overview

The Known Weaknesses panel of the test lists the attacks a server can be exposed to. Most of them need an old protocol version, a weak cipher suite, or software that was never patched, so a well-kept server is affected by none of them. Each entry below explains the attack in a few lines and says what removes it.

The test marks each one affected, not affected, or inconclusive when it cannot tell. A weakness read from the protocols and cipher suites is always decided; a few are confirmed by sending a crafted message and reading the answer.

POODLE (SSL 3.0)

POODLE (Padding Oracle On Downgraded Legacy Encryption, CVE-2014-3566) uses the fact that SSL 3.0 does not check the padding of a CBC record. An attacker who sits between the client and the server and can make the browser repeat a request byte by byte recovers secrets such as a session cookie.

Fix: turn SSL 3.0 off. Nothing in use still needs it.

BEAST

BEAST (Browser Exploit Against SSL/TLS, CVE-2011-3389) exploits the predictable initialization vectors of CBC cipher suites in TLS 1.0 and SSL 3.0. A man in the middle who can inject chosen data next to a secret decrypts it a byte at a time. Current browsers work around it by splitting records, but the server-side fix is the real one.

Fix: offer TLS 1.2 or later and prefer AEAD cipher suites (GCM or ChaCha20-Poly1305).

SWEET32

SWEET32 (CVE-2016-2183) is a birthday attack on 64-bit block ciphers such as 3DES. After enough data is sent under one key, two blocks collide and leak a relationship between plaintexts, which over a long-lived connection is enough to recover a secret.

Fix: disable 3DES and any other 64-bit block cipher.

FREAK

FREAK (Factoring RSA Export Keys, CVE-2015-0204) affects servers that still offer export-grade RSA key exchange, whose keys are only 512 bits. A man in the middle downgrades the connection to such a suite and factors the key offline, then reads or alters the traffic.

Fix: remove all export cipher suites.

Logjam

Logjam downgrades a Diffie-Hellman key exchange to export-grade 512-bit parameters, which can be broken in near real time, or relies on common 1024-bit groups that a well-resourced attacker can precompute. Either way the session key is recovered.

Fix: remove export suites, use Diffie-Hellman parameters of at least 2048 bits, and prefer elliptic-curve key exchange (ECDHE).

CRIME

CRIME (Compression Ratio Info-leak Made Easy, CVE-2012-4929) reads a secret out of the length of a compressed record: by guessing bytes and watching whether the compressed request shrinks, an attacker recovers a cookie.

Fix: turn TLS compression off. It is off by default in current software.

RC4

The RC4 stream cipher has statistical biases in its output. Given enough connections that encrypt the same secret, those biases recover it. RFC 7465 forbids RC4 for this reason.

Fix: remove every RC4 cipher suite.

Insecure renegotiation

Before RFC 5746, a man in the middle could open a connection, send data of its own, and then splice the client's real handshake onto it, so the server treated the attacker's data as the client's (CVE-2009-3555). Secure renegotiation ties each renegotiation to the connection it belongs to.

Fix: enable secure renegotiation (RFC 5746), which every current TLS stack supports.

DROWN

DROWN (Decrypting RSA with Obsolete and Weakened eNcryption, CVE-2016-0800) uses a server that still speaks SSL 2.0 as an oracle to decrypt modern TLS sessions, even when the modern session itself is sound. It also works when any other server shares the same RSA key.

Fix: disable SSL 2.0 everywhere the certificate's key is used.

NULL cipher suites

A NULL cipher suite performs the handshake but then sends the data with no encryption at all. Anyone on the path reads everything.

Fix: remove every NULL cipher suite.

Anonymous cipher suites

An anonymous cipher suite encrypts the data but does not authenticate the server, so a man in the middle can impersonate it and read everything with no warning to the client.

Fix: remove every anonymous cipher suite.

Heartbleed

Heartbleed (CVE-2014-0160) is a bug in the OpenSSL heartbeat extension: a request that claims a large payload while carrying a small one makes the server reply with that much of its own memory, which can hold private keys, passwords or other users' data.

Fix: update OpenSSL. It has been fixed since April 2014; a private key exposed before the fix should be replaced.

OpenSSL CCS injection

The OpenSSL ChangeCipherSpec injection bug (CVE-2014-0224) lets a man in the middle send a ChangeCipherSpec message too early, so both sides derive keys from an empty secret the attacker knows, and the traffic can be read or changed.

Fix: update OpenSSL to a version from June 2014 or later.

Ticketbleed

Ticketbleed (CVE-2016-9244) is a bug in F5 BIG-IP appliances: when a client offers a session ticket, the server echoes a session id padded from uninitialized memory, leaking that memory much as Heartbleed does.

Fix: apply the F5 update, or turn the session ticket feature off until it is applied.

ROBOT

ROBOT (Return Of Bleichenbacher's Oracle Threat) is a return of a 1998 attack: with RSA key exchange, a server that answers a malformed encrypted premaster differently from a well-formed one is an oracle an attacker uses to decrypt a recorded session or forge a signature.

Fix: prefer forward-secret key exchange (ECDHE) and update the TLS software; the safest step is to stop offering RSA key exchange suites.

POODLE-TLS

POODLE-TLS (CVE-2014-8730) is POODLE carried into TLS: some implementations copied SSL 3.0's habit of not checking CBC padding, so the padding-oracle attack works against TLS as well.

Fix: update the TLS software; prefer AEAD cipher suites over CBC.

GOLDENDOODLE

GOLDENDOODLE is a CBC padding oracle in which the server's answer reveals whether a record's padding was correct while its MAC was not. It is faster and more reliable than the original POODLE and lets an attacker recover or forge data.

Fix: update the TLS software; prefer AEAD cipher suites over CBC.

Zombie POODLE

Zombie POODLE is another CBC padding oracle: the server tells a padding error apart from a MAC error in the way it answers, which an attacker turns into a decryption oracle.

Fix: update the TLS software; prefer AEAD cipher suites over CBC.

Client-initiated renegotiation

Renegotiation repeats the handshake on an open connection. When the server lets the client start it, a single client can force the server to do the expensive handshake work over and over, which costs the client almost nothing: a denial-of-service lever. This is not the same as insecure renegotiation; secure renegotiation can still be enabled and this still apply.

Fix: turn client-initiated renegotiation off, or rate-limit it. Servers do not need it.

Revoked certificate

A revoked certificate is one the certificate authority has declared invalid before its expiry, usually because its private key was exposed or it was issued in error. A client that checks revocation refuses it, and it must no longer be trusted.

Fix: replace the certificate with a new one, and find out why the old one was revoked; a key that was exposed must not be reused.