Protect against POODLE vulnerability on Virtualization Manager

10/18/2018 4:32 PM

5/30/2019 9:37 PM

This article applies to Virtualization Manager. For information about protecting against the Poodle security vulnerability (CVE-2014-3566)  on VIM. (© 1999 - 2018 The MITRE Corporation, available at https://cve.mitre.org, obtained on October 18, 2018.)

 

Virtualization Manager

To disable SSLv3 for Virtualization Manager, modify the configuration of Tomcat and lighttpd.
 

Tomcat 

To modify the Tomcat configuration of the Virtualization Manager user interface:

1. Open the /usr/share/tomcat/conf/server.xml file, and then search for the line which reads sslProtocol="TLS".
2. Insert the following string to a new line underneath:
   • sslEnabledProtocols="TLSv1, TLSv1.1, TLSv1.2"
3. Save the file.

Lighttpd 

To modify the lighttpd configuration of the Virtualization Manager management console:SSLv3 support cannot be turned off for the currently used version of lighttpd, but you can disable the vulnerable CBC mode of SSLv3.

1. Open the /opt/vmware/etc/lighttpd/lighttpd.conf file.
2. Replace the cipher list at the end of the file with the following list
   • ssl.cipher-list = "TLSv1+HIGH:!SSLv2:RC4+MEDIUM:!KRB5-DES-CBC3-MD5:!KRB5-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!EDH-DSS-DES-CBC3-SHA:!DES-CBC3-SHA:!AES128-SHA:!AES256-SHA:!aNULL:!eNULL"
3. Save the file.

Disclaimer: Please note, any content posted herein is provided as a suggestion or recommendation to you for your internal use. This is not part of the SolarWinds software or documentation that you purchased from SolarWinds, and the information set forth herein may come from third parties. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment.  You elect to use third party content at your own risk, and you will be solely responsible for the incorporation of the same, if any.