0

I have set up a test web server on CentOS 7 to find a way to fix Padding Oracle vulnerability, which I got when I scanned our production site on ssllabs.com. On the test server, I installed openssl(1.0.2j, which is latest as of 1/12/2017) and apache(2.4.25, which is also latest as of 1/12/2017) from source and made some basic changes to apache configuration such as SSL. After making sure SSL works by accessing it with a web browser, I scanned the test site on ssllabs.com, which told me that it still had the same vulnerability. I thought the test site would pass it because the bug was already fixed at the release of 1.0.2h according to the Openssl official site. I have no idea what else to try next. Any advice would be appreciated.

I think the apache uses the openssl I installed instead of the other one (1.0.1e), which is built in on CentOS7. Below is one of what I did to make sure of that.

Under the condition of ServerTokens Full

[root@*** ~]# curl --head http://***.*********.com
HTTP/1.1 200 OK
Date: Thu, 12 Jan 2017 19:52:31 GMT
Server: Apache/2.4.25 (Unix) OpenSSL/1.0.2j
Last-Modified: Mon, 11 Jun 2007 18:53:14 GMT
ETag: "2d-432a5e4a73a80" 
Accept-Ranges: bytes
Content-Length: 45
Content-Type: text/html
Improve this question
4
  • What padding oracle vulnerability? Why haven't you just installed the distribution updates?
    – Michael Hampton
    Jan 12, 2017 at 20:58
  • I wish I could just use yum to install them. I used to do that way, but I have to keep updating them to clear PCI compliance, so this is the only way I can think of so far. I didn't know that vulnerability until I got it when I scanned our website. If you want to know the detail, this is the link to the explanation (I tried to read it, but it was too hard for me to understand..). blog.cloudflare.com/…
    – masa
    Jan 12, 2017 at 21:27
  • Your OS distribution updates are sufficient for PCI compliance.
    – Michael Hampton
    Jan 12, 2017 at 21:29
  • Ok. I will try that. I started installing them from source when I was using CentOS 6 and I haven't tried yum on CentOS 7 yet. So it's worth a try. But the main point of my question is that what part of software/configuration the vulnerability is coming from. Actually our PCI compliance scan does not catch this vulnerability. I realized it when I happened to scan from ssllabs.com. So I don't know how serious it is, but our site was rated F on the site, which I think is really bad. I am trying to find out what is causing it.
    – masa
    Jan 12, 2017 at 21:47

0

Reset to default

Browse other questions tagged .