Protecting Uniserver Zero against POOGLE

[iltdevunit]

I've just read up on the latest SSL attack:

https://threatpost.com/new-poodle-ssl-3-0-attack-exploits-protocol-fallback-issue/108844

 

The patches I've seen so far are for Apache on Linux or IIS on Windows. Does anyone know how to apply the fix to Uniserver Zero i.e. Apache on Windows?

[Ric]

Edit file C:\UniServerZ\core\apache2\conf\extra\httpd-ssl.conf

Locate this section:

#== SSL Cipher Suite:
SSLProtocol -all +TLSv1 +SSLv3
SSLCipherSuite HIGH:MEDIUM:!aNULL:+SHA1:+MD5:+HIGH:+MEDIUM

Replace with:

#== SSL Cipher Suite:
SSLProtocol all -SSLv2 -SSLv3
SSLHonorCipherOrder on
SSLCipherSuite AES256+EECDH:AES256+EDH

Note: Above added starting from Uniform Server 11.4.0-ZeroXI

 

All the best
Ric