How to implement RFC 5746 and fix CVE-2009-3555 on Plesk 10.3.1

[thekman]

We are currently running Plesk 10.3.1 and are aware of the need to update our server to fix CVE-2009-3555 (RFC 5746) SSL/TLS vulnerability. I have seen a few posts from last year when people tried to update Plesk 9 and found a raft of problems which were later resolved, however we are on 10.3.1 and still have this problem. I believe it has something to do with requiring the latest mod_ssl which is part of apach 2 however my knowledge in this area is not great.

I have tried executing as root > yum update mod_ssl however I am told that no updates are available.

One thought I had is that like many people I too have Plesk 10.3.1 components that will not install and wondered if that might be the cause of why apache / mod_ssl isn't already updated.

It is very important to us to perform this update as our customers are complaining of warnings in firefox's error console about our ecommerce website being vulnerable to MIM type attacks.

I would be grateful if someone from Plesk could confirm whether 10.3.1 should already have the latest apache / mod_ssl versions which implement RFC 5746. If you could also find a solution to the components not updating problem that would be great too.

Many thanks,
thekman.

 

[thekman]

I have now managed to update to the 10.3.1 components and they had no effect. If someone could please offer any advice on how we resolve this issue it would be much appreciated.

 

[breun]

Plesk just uses whatever httpd and mod_ssl packages are provided by your OS vendor. So first question: what OS are you running?

 

[thekman]

Hi Breun,

Thanks for the reply, I am running CentOS 5, details from Plesk are as follows. I was under the impression that Plesk was responsible for the updating of Apache and modules etc, I take it that isn't the case. As I mentioned in my post, I did try to update mod_ssl etc but it stated there were no updates.

CPU - AuthenticAMD, Quad-Core AMD Opteron(tm) Processor 2352
Version - Parallels Plesk Panel v10.3.1_build1013110726.09 os_CentOS 5
OS - Linux 2.6.18-028stab092.1

Many thanks.

 

[breun]

I was under the impression that Plesk was responsible for the updating of Apache and modules etc, I take it that isn't the case.

You'll need to keep your OS up-to-date yourself and by default Plesk uses the httpd package provided by your OS vendor. (Unless you choose the option to use Apache with SNI support, I believe you get a custom httpd package from Parallels in that case.)

As I mentioned in my post, I did try to update mod_ssl etc but it stated there were no updates.

What versions do you have installed currently? Run rpm -q httpd mod_ssl to check.

According to http://www.redhat.com/security/data/cve/CVE-2009-3555.html the security update for httpd in EL5 was released in November 2009: https://rhn.redhat.com/errata/RHSA-2009-1579.html

 

[thekman]

Here are my versions, and yes I think I am running Apache with SNI but for the life of me I cannot remember why. I am sure it had something to do at the time with how are SSL certificate was implemented but I will need to look into that.

httpd-2.2.21-11092115
mod_ssl-2.2.21-11092115

Many thanks.

 

[breun]

SNI lets you use multiple SSL certificates on a single IP address. I don't know if Plesk's httpd/mod_ssl packages with SNI support contain a fix for CVE-2009-3555.