Hello,

Moved to the Security Forum.

Welcome to the forums. The big issue about this question, and it actually comes up a lot, is how the 'tool' you are using is finding this vulnerability. I imagine it is looking at the version of OpenSSL installed on the host and not actually trying to run an exploit. If it is looking at the version # then it is a false positive, as like RedHat, VMware backports changes into OpenSSL without changing the version number of the package.

If it is testing the certificates in use, then replace the self-signed certificates with your own signed certificates.


Best regards,
Edward L. Haletky VMware Communities User Moderator, VMware vExpert 2009, Virtualization Practice Analyst
Now Available: 'VMware vSphere(TM) and Virtual Infrastructure Security: Securing the Virtual Environment'
Also available 'VMWare ESX Server in the Enterprise'
SearchVMware Pro|Blue Gears|Top Virtualization Security Links|Virtualization Security Round Table Podcast

It is the case that these weaker ciphers are currently supported. This is being addressed, but IMHO the risk is VERY minimal. The fact is that the only way this risk could be realized is if one of your administrators used a browser that only supported the weak ciphers. The VIC, nor do most modern browsers support weak ciphers. From my perspective, this is more of a concern for a public facing website to allow this, since you don't necessarily know what the "users" of the website are using for their browser. In a corporate environment, you should be able to control what browser your administrators are using which will completely mitigate this risk.

I tend to agree with you that the risk is minimal but some security officers/auditors like to have "clean" scan results.

It is good to know that this is being addressed as this will avoid lenghty discussions with auditors in the future.

Hello,

You could change it in these files.... Not sure what would happen but do not think it is an issue.....

/usr/lib/vmware/webAccess/tomcat/*/conf/server.xml

However, not everything uses tomcat either so there are other concerns as well. This just fixes it for webAccess which includes anything using the VI-SDK, etc.


Best regards,
Edward L. Haletky VMware Communities User Moderator, VMware vExpert 2009, Virtualization Practice Analyst
Now Available: 'VMware vSphere(TM) and Virtual Infrastructure Security: Securing the Virtual Environment'
Also available 'VMWare ESX Server in the Enterprise'
SearchVMware Pro|Blue Gears|Top Virtualization Security Links|Virtualization Security Round Table Podcast