Weak SSL Cipher support revisited

Message

dasfx · #1 Post by **dasfx** » 2009-11-24 21:33

Hello,
Unfortunately I have customers which are required to go through PCI compliance scans. One of the more recent scans flagged the FileZilla server for weak SSL cipher support. Currently the server is running the latest version (0.9.33), so this means no SSLv2, however when testing (OpenSSL, perl and ServerSniff.net) I see the following:
DES-CBC-SHA -- 56 bits, Low Encryption

Which is being flagged by the scanning vendor. Are there plans to remove support for the 56-bit cipher or perhaps a workaround? I know PCI can be BS, but the customers doesn't really have a choice if they want to keep processing credit cards.

Thank you in advance,

Dave

Solido · #2 Post by **Solido** » 2009-11-26 12:32

I'm really interested in this concern. Thank you for leverage this question.
Sol

cyberknutte · #3 Post by **cyberknutte** » 2009-11-30 14:28

Hi,

I have the same issue. Our company is PCI DSS certified and we would like to use Filezilla Server. We use Qualys as security scanner and this is the result:

Level 3 vulnerabilities is not allowed for PCI DSS compliance.

Best regards,
Andreas

redswimmer · #4 Post by **redswimmer** » 2009-12-29 20:19

Having the same issue with Qualys saying our FileZilla server is using the following "WEAK Ciphers": DES-CBC-SHA and DES-CBC-SHA

#5 Post by **botg** » 2009-12-29 21:29

These ciphers will be disabled in the next version of FileZilla Server. I thought had disabled them already by disallowing SSLv2, but somehow OpenSSL did still pull them in for some reason.

I sat down with the library and had a stern talk with it about ciphers.

redswimmer · #6 Post by **redswimmer** » 2009-12-29 22:28

I really appreciate it, thanks. Does the next release have an estimated date by chance?

#7 Post by **botg** » 2009-12-29 23:04

This year.

redswimmer · #8 Post by **redswimmer** » 2009-12-30 00:06

Excellent. Glad to hear I got in under the wire. Thanks again!

#9 Post by **boco** » 2009-12-30 17:27

botg wrote:This year.

You have plenty of time --- or not?

monorailpilot · #10 Post by **monorailpilot** » 2010-01-05 13:49

Thanks. Much appreciated here as well.

dasfx · #11 Post by **dasfx** » 2010-01-11 20:24

This is why I love open source. Thanks much!

Dave

FileZilla Forums

Weak SSL Cipher support revisited

Weak SSL Cipher support revisited

Re: Weak SSL Cipher support revisited

Re: Weak SSL Cipher support revisited

Re: Weak SSL Cipher support revisited

Re: Weak SSL Cipher support revisited

Re: Weak SSL Cipher support revisited

Re: Weak SSL Cipher support revisited

Re: Weak SSL Cipher support revisited

Re: Weak SSL Cipher support revisited

Re: Weak SSL Cipher support revisited

Re: Weak SSL Cipher support revisited