| Beast Vulnerability [message #128939] |
Wed, 13 April 2016 08:32  |
jiunnyik
Messages: 43
Registered: December 2013
|
|
|
|
Hi,
There is beast vulnerability warning when I run ssl check on Kerio 9.0.2.
Any idea to solve this?
Thank you.
|
|
|
|
|
|
|
|
|
|
| Re: Beast Vulnerability [message #128948 is a reply to message #128939] |
Wed, 13 April 2016 09:45  |
Lukas Petrlik (Kerio)
Messages: 99
Registered: March 2008
|
|
|
|
jiunnyik wrote on Wed, 13 April 2016 08:32There is beast vulnerability warning when I run ssl check on Kerio 9.0.2. Kerio Connect 9.0.2 is not vulnerable to BEAST. Could you please point me to the SSL test that reports it?
BTW, Kerio Connect does not use system-wide OpenSSL libraries - it uses a patched version installed by its installer instead.
|
|
|
|
|
|
| Re: Beast Vulnerability [message #128955 is a reply to message #128950] |
Wed, 13 April 2016 11:30 |
Lukas Petrlik (Kerio)
Messages: 99
Registered: March 2008
|
|
|
|
I see what they mean, and it deserves an explanation. BEAST is a browser-side vulnerability that cannot be exploited in current browsers (see e.g. this article published on Qualys blog). Historically most servers attempted to mitigate the problem by prioritizing SSL/TLS ciphersets based on the RC4 stream cipher - but it was later found that the RC4 cipher is weaker than it was previously thought.
In other words: The consensus is that BEAST is not a threat anymore. Attempts to placate vulnerability tests by enabling RC4 would make your servers less secure.
|
|
|
|
|
|
Members
Search
Help
Register
Login
Home
