Subject: [Imap-uw] Disable SSL v2

From: Andrew Voltmer <[email-masked]>
Date: Thu, 30 Jun 2005 21:34:06 -0700

Hello,

I am looking for a solution to a security issue related to the WU-IMAP 
server. I have a security scanning tool that is reporting that my imapd 
daemon is doing SSL v2 over 993 on my IMAP server. It suggests that I 
need to disable SSL v2 to prevent any issues related to SSL v2 
vulnerabilites. I know this was a major issue with Apache and ISS 
servers that did SSL v2 support so I assume it may also be an issue in 
an IMAP environment. Does anyone know a way to disable SSL v2 support in 
the WU-IMAP server? Thanks.

Sincerely,
Andy Voltmer
[email-masked]
_______________________________________________
Imap-uw mailing list
[email-masked]
https://mailman1.u.washington.edu/mailman/listinfo/imap-uw

---

From: Mark Crispin <[email-masked]>
Date: Fri, 1 Jul 2005 07:13:14 -0700 (PDT)

On Thu, 30 Jun 2005, Andrew Voltmer wrote:
> daemon is doing SSL v2 over 993 on my IMAP server. It suggests that I need to 
> disable SSL v2 to prevent any issues related to SSL v2 vulnerabilites. I know 
> this was a major issue with Apache and ISS servers that did SSL v2 support so 
> I assume it may also be an issue in an IMAP environment. Does anyone know a 
> way to disable SSL v2 support in the WU-IMAP server? Thanks.

I don't know what these "issues related to SSL v2 vulnerabilities" are; 
thus I can not comment intelligently on whether or not it affects IMAP in 
any way.  Are you building UW (not WU) imapd with the latest version of 
OpenSSL?

SSL IMAP on port 993 is defined to use the SSLv23 method, and the STARTTLS 
command on port 143 is defined to use the TLSv1 method.  Changing to some 
other method can break interoperability between clients and servers. 
There have been interoperability problems with clients that incorrectly 
chose SSLv23 instead of TLSv1 when doing TLS on port 143.

If you really need to disable SSL v2, then it may be that the best thing 
is simply to disable port 993 service and require that everybody use port 
143 and STARTTLS.  This has the additional desirable side effect of 
breaking clients that do SSL but not TLS, thus forcing your users to use 
good TLS-capable IMAP clients such as Pine. :-)

-- Mark --

http://staff.washington.edu/mrc
Science does not emerge from voting, party politics, or public debate.
Si vis pacem, para bellum.
_______________________________________________
Imap-uw mailing list
[email-masked]
https://mailman1.u.washington.edu/mailman/listinfo/imap-uw

---

From: Rich Graves <[email-masked]>
Date: Fri, 1 Jul 2005 11:10:40 -0400 (EDT)

There are reasons that SSL went to v3 (and SSH to v2, Kerberos to v5, etc).
Most are probably of only theoretical interest, but in a very high security
environment, it's valid to worry about such things. Personally and for the
Brandeis production servers, I currently don't.

You can disable SSLv2 or specific crypto algorithms at OpenSSL build time.  
I don't know if it's possible to do it at link or run time. If he's on a
platform where he's compiling everything from source anyway, Andrew should
read through the OpenSSL docs and configure OpenSSL appropriately. If he's
using vendor binaries of *anything* and recompiling basic packages would be
a hassle, then he should read enough about crypto to tell auditors that
he's made an informed decision.

Clients that support both v2 and v3 will always use v3, so the fact that 
the server supports v2 is only an issue if you're worried about fairly
determined man-in-the-middle attackers. For best security, as Mark said, 
use TLS on 143, but your choice of IMAP clients will be limited.
-- 
Rich Graves <[email-masked]>
UNet Systems Administrator

---

From: Chris Ross <[email-masked]>
Date: Fri, 1 Jul 2005 12:12:52 -0400

On Jul 1, 2005, at 11:10, Rich Graves wrote:
> I don't know if it's possible to do it at link or run time.

   From looking at the documentation for mutt, it appears you can disable
sslv2, sslv3 and tlsv1 each independently.  So, from that I assume it's
possible to do at runtime...

       - Chris