Zombie Poodle / Goldendoodle cipher suite trim on server2016

Mr. Zacks 1 Reputation point
2022-01-28T13:52:55.397+00:00

our security team flagged a few of our windows servers as vulnerable to CVE-2019-1559 Zombie POODLE and GOLDENDOODLE.
reading up on it , I think the resolution is to remove all CBC based cipher suites.
is this correct ?
if so, what is the correct way of doing that ?
am i correct in thinking that running the PS cmdlt:
Disable-TLSCipherSuite followed by the CBC cipher suites should achieve that goal ?

thanks

Windows Server Security
Windows Server Security
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
1,732 questions
0 comments

4 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Reza-Ameri 16,836 Reputation points
    2022-01-28T15:31:50.497+00:00

    This vulnerability is not related to Microsoft product and Windows Server and it might be related to products installed on the Windows Server, it affect if you are running products like F5 or Citrix and you should check what products are affected and look into their support website and take actions.
    Windows Server itself is protected against this attack and vulnerabilities affected by products installed on the Windows Server.

    1 person found this answer helpful.
  2. Pierre Audonnet - MSFT 10,166 Reputation points Microsoft Employee
    2022-01-31T16:15:26.783+00:00

    I concur with @Reza-Ameri , the CVE you are quoting is not affecting the Windows operating systems as it is an OpenSSL vulnerability and Windows has its own implementation on SSL not based on OpenSSL. As mentioned previously, you can have third-party products installing OpenSSL on a Windows system and that's generaly the third-party app owning the fix (hence the absence of this CVE in the MSRC website).
    The vulnerability is neither in the protocol, nor in the algorithms, but in the implementation. It is affecting the OpenSSL's implementation of these protocols and algorithms.

    If your security team tagged Windows servers as vulnerable, it is probably because they have one of those third party software bringing OpenSSL in. And in that case, you need to fix the OpenSSL binaries. The cmdLet you mentioned only configures the Windows' implementation. Not touching the OpenSSL binaries.

    0 comments
  3. Mr. Zacks 1 Reputation point
    2022-01-31T16:37:32.38+00:00

    i opened a case with Microsoft to verify this.
    i can see from the CVE details that it is referencing the openssl only. but the qualys scans points to the micorosoft ciphers. it might be a false positive..
    i'll update here with their response when i get it

  4. Jccaraan 1 Reputation point
    2022-03-06T23:49:06.473+00:00

    Thats awesome! will wait. TIA!