RE: Disable SSL v2 ciphers on IIS 5.0

["xxradar" <xxradar () radarhack com>]

Hi
I agree on disabling accurately the protocols.  When SSL is activated, quite
often PCT is activated to, proven to be very vulnerable and exploitable.
(and cannot be tested , I believe, with openssl). 

Another doc proven to be usefull in the past to me,
http://www.foundstone.com/resources/whitepapers/wp_ssldigger.pdf


Greetings,

-----Original Message-----
From: Doug Markiewicz [mailto:doug.markiewicz () vigilantminds com] 
Sent: Wednesday, July 19, 2006 4:12 PM
To: secmail.lists () gmail com; webappsec () securityfocus com
Subject: RE: Disable SSL v2 ciphers on IIS 5.0

The article you pointed to covers disabling protocols not ciphers.  You
should disable everything but SSLv3 and TLSv1 on the protocol front.
You also want to restrict the ciphers that are available.  This is a
separate registry change.  The following link should help you out:

How to control the ciphers for SSL and TLS
http://support.microsoft.com/kb/216482

How to Restrict the Use of Certain Cryptographic Algorithms and
Protocols in Schannel.dll
http://support.microsoft.com/kb/245030/


-----Original Message-----
From: secmail.lists () gmail com [mailto:secmail.lists () gmail com] 
Sent: Tuesday, July 18, 2006 4:53 PM
To: webappsec () securityfocus com
Subject: Disable SSL v2 ciphers on IIS 5.0


All -

I am looking to have a client disable SSL v2 ciphers on IIS 5.0 any idea
on how to do it? I checked technet and others and it seems to be a
mistery. I reommended the follwing:
http://support.microsoft.com/kb/187498/en-us

The admin made the registry changes and bounced the server yet the
ciphers still report they are available (note I used openssl s_client
... to test)

Thanks
Don

------------------------------------------------------------------------
-
Sponsored by: Watchfire

AppScan 6.5 is now available! New features for Web Services Testing, 
Advanced Automated Capabilities for Penetration Testers, PCI Compliance 
Reporting, Token Analysis, Authentication testing, Automated JavaScript 
execution and much more. 
Download a Free Trial of AppScan today!

https://www.watchfire.com/securearea/appscancamp.aspx?id=70150000000CYkc
------------------------------------------------------------------------
-



-------------------------------------------------------------------------
Sponsored by: Watchfire

AppScan 6.5 is now available! New features for Web Services Testing, 
Advanced Automated Capabilities for Penetration Testers, PCI Compliance 
Reporting, Token Analysis, Authentication testing, Automated JavaScript 
execution and much more. 
Download a Free Trial of AppScan today!

https://www.watchfire.com/securearea/appscancamp.aspx?id=70150000000CYkc
-------------------------------------------------------------------------


-- 
No virus found in this incoming message.
Checked by AVG Free Edition.
Version: 7.1.394 / Virus Database: 268.10.2/393 - Release Date: 7/19/2006
 

-- 
No virus found in this outgoing message.
Checked by AVG Free Edition.
Version: 7.1.394 / Virus Database: 268.10.2/393 - Release Date: 7/19/2006
 


-------------------------------------------------------------------------
Sponsored by: Watchfire

AppScan 6.5 is now available! New features for Web Services Testing, 
Advanced Automated Capabilities for Penetration Testers, PCI Compliance 
Reporting, Token Analysis, Authentication testing, Automated JavaScript 
execution and much more. 
Download a Free Trial of AppScan today!

https://www.watchfire.com/securearea/appscancamp.aspx?id=70150000000CYkc
-------------------------------------------------------------------------