Plesk 11 Not PCI Compliant - BEAST (Browser Exploit Against SSL/TLS) Vulnerability

[J.Wick]

BEAST (Browser Exploit Against SSL/TLS) Vulnerability
CVE: CVE-2011-3389
Centos 5.9
Plesk 11.0.9 Update #34
Scanner: Trustwave

Description
The SSL protocol encrypts data by using CBC mode with chained initialization vectors. This allows an attacker, which is has gotten access to an HTTPS session via man-in-the-middle (MITM) attacks or other means, to obtain plain text HTTP headers via a blockwise chosen-boundary attack (BCBA) in conjunction with Javascript code that uses the HTML5 WebSocket API, the Java URLConnection API, or the Silverlight WebClient API. This vulnerability is more commonly referred to as Browser Exploit Against SSL/TLS or "BEAST".

Remediation
Affected users should disable all block-based cipher suites in the server's SSL configuration and only support RC4 ciphers, which are not vulnerable to fully address this vulnerability. This vulnerability was addressed in TLS version 1.1/1.2, however, support for these newer TLS versions is not widely supported at the time of this writing, making it difficult to disable earlier versions. Additionally, affected users can also configure SSL to prefer RC4 ciphers over block-based ciphers to limit, but not eliminate, exposure. Affected users that implement prioritization techniques for mitigation as described above should appeal this vulnerability and include details of the SSL configuration.

Does anyone know how to fix this? I tried creating a cipher.lst and it didn't work. This is crazy Plesk isn't compliant with properly configured ciphers.

 

[IgorG]

Solution described in documentation:

http://download1.parallels.com/Ples...compliance-guide/index.htm?fileName=65871.htm

If your ASV (Authorized Scanning Vendor) requires mitigating the BEAST attack as a PCI compliance requirement, you should additionally update the ciphers suite as described below:
.....

 

[J.Wick]

Solution described in documentation:

http://download1.parallels.com/Ples...compliance-guide/index.htm?fileName=65871.htm

Great, this worked!

I wish Plesk would naturally be PCI-Compliant right from install without having to tweak.

Thanks!

 

[LinqLOL]

@igorg will this also fix nginx?

Anyways what I see in my nginx config files:

ssl_ciphers HIGH:!aNULL:!MD5;

This will not survive the BEAST attack.