How to address SSL/TLS vulnerabilities on Windows Server 2019 (CVE-2002-20001, CVE-2022-40735,CVE-2013-2566, CVE-2015-2808, CVE-2015-4000)

Question

Need direction with resolving (or accurately documenting false positive) two vulnerabilities that are being detected by vulnerability scans.

1 - Weak' cipher suites accepted by this service via the TLSv1.2 protocol: TLS_RSA_WITH_RC4_128_MD5 TLS_RSA_WITH_RC4_128_SHA (TCP ports 636 and 3389)

2 - 'DHE' cipher suites accepted by this service via the TLSv1.2 protocol: TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (TCP port 3389)

The vulnerabilities above are being detected across the board in my server environment including a DC, an RDS farm, and a few application servers.

I have tried to use the following resource to restrict the use of Ciphers without success.

https://learn.microsoft.com/en-us/windows-server/security/tls/tls-registry-settings?tabs=diffie-hellman

https://learn.microsoft.com/en-us/answers/questions/1006253/how-to-know-which-versions-of-tls-is-are-enabled-o

Answer 1

Hello there,

If you have specific reasons to keep these cipher suites enabled for compatibility with older systems or applications, you can document these vulnerabilities as false positives in your security documentation. Be sure to include a clear explanation of why these cipher suites are enabled, the associated risks, and any compensating controls you have in place to mitigate those risks.

The 'DHE' cipher suites are considered secure, but you can further enhance security by ensuring that your servers support forward secrecy. Forward secrecy ensures that even if an attacker obtains the server's private key, they cannot decrypt past communication sessions.

Hope this resolves your Query !!

--If the reply is helpful, please Upvote and Accept it as an answer–

Answer 2

Did you every figure how to fix this?

(So CVE-2022-40735, CVE-2002-20001 dont show up when doing a vulnerability scanning.)