Troubleshooting
Problem
A known SSL/TLS vulnerability, CVE-2011-3389 (also known as BEAST), exists in the SSLv3 and TLS 1.0 protocols. To eliminate this vulnerability, please review the specific configuration recommendations below.
Symptom
Refer to CVE-2011-3389
Resolving The Problem
The following describes how to prevent the CVE-2011-3389 vulnerability on any firmware version of the IBM WebSphere DataPower appliance.
The protocol problem in this case is the use of a predictable IV (initialization vector) when block cipher CBC mode is used. There are two ways to prevent the attack.
1. use TLS 1.1 or TLS 1.2
The protocol problem that allows the attack was fixed completely starting in TLS 1.1 which changed the spec to use a new, random IV in each encrypted SSL record.
DataPower firmware release 6.0.0 added support for TLS 1.1 or TLS 1.2 by default. To protect the appliance against the vulnerability enable support for TLS 1.1 and TLS 1.2 in the Crypto Profile while disabling support for TLS 1.0, SSLv3, and SSLv2.
DataPower firmware releases prior to 6.0.0 do not support TLS 1.1 or TLS 1.2 and therefore must use option #2 below to avoid the vulnerability.
2. Enable the empty data record counter measure (CLI only)
This counter measure can only be enabled using the command line interface (it is not available in the WebGUI).
This counter measure is to send empty data records between the usual data records to effectively randomize the IV value. This behavior is legal according to the SSL/TLS specifications, but some SSL/TLS stacks are not fully compliant to this specification and will reject connections that send such records. Therefore use of this setting may result in incompatibility with SSL/TLS stacks that are not standards compliant such as the one in some versions of Microsoft Internet Explorer (IE).
The Crypto Profile has a property called Options. Using the command line interface, set the Options field by entering crypto mode and using the profile command with an options mask of 0x10007FF:
profile name idCred [ssl name] [ciphers cipher-string] [options mask]
For example, a Crypto Profile named "alice-cp" uses an Identification Credential named "alice-idcred". The following CLI commands will enable the empty data record counter measure for this Crypto Profile:
top
configure terminal
crypto
profile alice-cp alice-idcred options 0x10007FF
This counter measure only protects one half of the duplex (outgoing data from DataPower). It is up to the SSL peer to protect the other half of the duplex with the same counter measure. If this is undesirable then use #1 or #3 instead.
3. Use SSL Server Profile or SSL SNI Server Profile with firmware version 7.2.0 or later
In 7.2.0 release, IBM DataPower Gateways introduced SSL Server Profile and SSL SNI Server Profile. These 2 profiles are not vulnerable to this advisory, as they will always send empty data records between the usual data records.
Was this topic helpful?
Document Information
Modified date:
19 August 2022
UID
swg21578730