How do i fix CVE-2016-2183

Question

Hello,

I would like to figure out how to remediate CVE-2016-2183. It is the Birthday attacks against TLS ciphers with 64bit (Sweet32)

currently i did the following:

Disable-TlsCipherSuite -Name "TLS_RSA_WITH_3DES_EDE_CBC_SHA" in the regkey "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\Triple DES 168"

However, even after this is ran the vulnerability still exists. What can be done to remediate this CVE.

Answer 1

The correct way to do this is not through the registry. Use below TlsCipherSuite cmdlet from https://learn.microsoft.com/en-us/powershell/module/tls/disable-tlsciphersuite?view=windowsserver2022-ps&viewFallbackFrom=winserver2012-ps

Disable-TlsCipherSuite -Name 'TLS_RSA_WITH_3DES_EDE_CBC_SHA'

Answer 2

Hello Jessica Rojas,

Thank you for posting in our Q&A forum.

Is your machine in a workgroup instead of in any domain?

You can restart the machine to see if it helps.

If it does not work, you can disable it by removing it from registry below: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Cryptography\Configuration\Local\SSL\00010002 and then restart the machine.

Similar thread for your reference.
https://learn.microsoft.com/en-us/answers/questions/348323/how-to-disable-3des-and-rc4-on-windows-server-2019

Tip: Please back up registry before you change it.

**
After that, we can run command below to check if it is disabled successfully.

**
Get-TlsCipherSuite -Name 3DES

Hope the information above is helpful. If you have any question or concern, please feel free to let us know.

Best Regards,
Daisy Zhou

==========================================

If the Answer is helpful, please click "Accept Answer" and upvote it.