CSCvi80849 - Cisco Firepower 2100 Series POODLE TLS security scanner alerts

[ThatOtherITDude]

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvi80849/?rfs=iqvred

Does anyone know what versions of FTD code fix this issue? The bug article only lists FXOS and ASA versions.

[Rob2041]

If you make a custom cipher set with TLS1.2 only and only use 

TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

TLS_DHE_RSA_WITH_AES_256_GCM_SHA384

TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384

TLS_DHE_RSA_WITH_AES_256_CBC_SHA256

The Poodle TLS issue will go away.

This is running FTD 7.0.1

[DWPCC]

Where does this custom cipher set get created? 

[Pavel Pokorny]

Hi,

I am sorry, but according to this https://blog.qualys.com/product-tech/2019/04/22/zombie-poodle-and-goldendoodle-vulnerabilities the problem will remain until you remove CBC ciphers.

You can edit ciphers in FMC under Devices -> Platform settings -> SSL -> Protocol version

HTH,

Pavel

[Marvin Rhoads]

Yes remove all CBC-based ciphers in your custom set for TLSv1.2 and DTLSv1.2. I use the following and get an A+ from Qualys SSL Labs:

ssl server-version tlsv1.2 dtlsv1.2
ssl client-version tlsv1.2
ssl server-max-version tlsv1.3
ssl client-max-version tlsv1.3
ssl cipher default medium
ssl cipher tlsv1 medium
ssl cipher tlsv1.1 medium
ssl cipher tlsv1.2 custom "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:DHE-RSA-AES256-SHA256"
ssl cipher tlsv1.3 medium
ssl cipher dtlsv1 medium
ssl cipher dtlsv1.2 custom "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:DHE-RSA-AES256-SHA256"
ssl dh-group group14
ssl ecdh-group group19

 The above should work fine as platform settings for any FTD 7.0 or greater.

[Pavel Pokorny]

Hi Marvin,

Same for me. I think you can even remove ECDSA ciphers from TLS 1.2. Most of the certificates I have met are with RSA key. 

Regards,

Pavel