TLS Diffie-Hellman Key Exchange Logjam Vulnerability

[Omar Khouli]

We have Cisco Security Manager 4.8 running on Windows Server 2008 R2, recently we have conducted a scan on the server, and the following vulnerability has been reported  "TLS Diffie-Hellman Key Exchange Logjam Vulnerability". Note that we have excluded weak ciphers !EXPORT from httpd.conf file and rerun scan but vulnerability still exists.

Is it related to OpenSSL version that comes integrated with CSM? How can this be mitigated?

[Richard Burts]

I have recently run into what sounds like a similar problem on a different platform. In our case it seems to be an issue about using Diffie-Hellman group 2 which uses 1024 bits. I wonder if that is the case with your platform also.

HTH

Rick