Poodle : New SSL 3.0 Bug (CVE-2014-3566)

Oct 14 2014, this bug CVE_2014-3566 has been found as a subtle but significant security weakness in version 3 of the SSL protocol. Severity level is Medium. Basically this vulnerability is not critical as Shellshock and Heartbleed. 

The vendors's Recommendations: 

1. Check Point response to the POODLE Bites vulnerability (CVE-2014-3566): 

a. Check Point Customers

• Check Point products are not vulnerable to the “POODLE Bites” vulnerability (CVE-2014-3566). See our Security Alert: sk102989
• Implement the IPS protection, CPAI-2014-1909, to detect or block the use of SSL 3.0
• Configure Multi Portal, HTTPS Inspection, and Check Point OS to prevent web browser use of SSL 3.0

b. Non Check Point Customers

• Use Active Directory Group Policy Objects to disable the use of SSL 3.0
• Update your browser when a patch is available
• Disable SSL 3.0 in your clients and servers
• Test if your browser is vulnerable at www.poodletest.com
• Test if a particular domain name is vulnerable at www.poodlescan.com

2. Juniper Responding:

a. Junos:

Junos OS will update OpenSSL to add support for SSL 3.0 Fallback protection (TLS_FALLBACK_SCSV) in a future release.

Connect Secure (SA / SSL VPN) / Policy Secure (IC / UAC), MAG Series:

Please refer to Pulse Secure TSB16540 for details on mitigating risk from this vulnerability.

b. ScreenOS:

A problem report has been submitted.  Development is in the process of evaluating the best method to resolve this issue.

c. Junos Space:

Disable SSLv3 by changing the following files.

/etc/httpd/conf.d/webProxy.conf

/etc/httpd/conf.d/ssl.conf

/etc/httpd/conf.d/webConf/webProxyCertAuth.conf

The following line needs to be updated to remove references to SSLv3:

Original:

SSLProtocol -ALL +SSLv3 +TLSv1

Updated:

SSLProtocol -ALL +TLSv1

Restart httpd by typing 'service httpd restart'.

A future release of Junos Space will disable SSLv3 by default.

d. STRM/JSA Series:

Development is working on a patch to resolve this issue.

e. NSM3000/NSMXpress:

Edit /etc/httpd/conf/ssl.conf and change the SSLProtocol entry to:

SSLProtocol all -SSLv2 -SSLv3

f. IDP Signature:

Juniper has released signature SSL:AUDIT:SSL-V3-TRAFFIC in Sigpack 2430 to detect SSLv3 traffic.

3. Cisco Event Response: POODLE Vulnerability:

Details are in Cisco Page : 

SSL Padding Oracle On Downgraded Legacy Encryption (POODLE) Vulnerability 

 Vulnerable Products

Customers interested in tracking the progress of any of the following bugs can visit the Cisco Bug Search Tool to view the defect details and optionally select Save Bug and activate the Email Notification feature to receive automatic notifications when the bug is updated.

Products and services listed in the subsections below have had their exposure to this vulnerability confirmed. Additional products will be added to these sections as the investigation continues.

Collaboration and Social Media

• Cisco Webex Social [CSCur27459]

Endpoint Clients and Client Software

• Cisco AnyConnect (Android) [CSCur31571]
• Cisco AnyConnect (Apple iOS) [CSCur31566]
• Cisco AnyConnect (Win/Mac/Linux) [CSCur27617]

Network Application, Service, and Acceleration

• Cisco ACE 4710 Application Control Engine (A5) [CSCur27691]
• Cisco ACE10 / ACE20 / 4710 (A3x) [CSCur27985]
• Cisco ACE30 Application Control Engine Module [CSCur23683]
• Cisco CSS 11500 Series Content Security Switch [CSCur27999]

Network and Content Security Devices

• Cisco Adaptive Security Appliance (ASA) Software [CSCur23709]
• Cisco Email Security Appliance (ESA) [CSCur27131]
• Cisco Intrusion Prevention System Solutions (IPS) [CSCur29000]
• Cisco Prime Security Manager (PRSM) [CSCur29172]

Network Management and Provisioning

• Cisco TelePresence MPS Series [CSCur33284]

Routing and Switching - Enterprise and Service Provider

• Cisco Application Policy Infrastructure Controller (ACI/APIC) [CSCur28110]
• Cisco IOS and Cisco IOS-XE (IOSd only) [CSCur23656]
• Cisco Nexus 3000 Series Switches [CSCur28178]
• Cisco Nexus 9000 (ACI/Fabric Switch) [CSCur28114]
• Cisco Nexus 9000 Series (standalone, running NxOS) [CSCur28092]

Unified Computing

• Cisco Standalone rack server CIMC [CSCur33929]

Voice and Unified Communications Devices

• Cisco IM and Presence Service (CUPS) [CSCur33203]
• Cisco Unified Communications Manager (CUCM) [CSCur23720]

Video, Streaming, TelePresence, and Transcoding Devices

• Cisco TelePresence Advanced Media Gateway 3610 [CSCur33286]
• Cisco TelePresence IP Gateway Series [CSCur33289]
• Cisco TelePresence IP VCR Series [CSCur33294]
• Cisco TelePresence ISDN Gateway [CSCur33282]
• Cisco TelePresence MCU (8510, 8420, 4200, 4500 and 5300) [CSCur33260]
• Cisco TelePresence MSE 8050 Supervisor [CSCur33267]
• Cisco TelePresence Serial Gateway Series [CSCur33297]
• Cisco TelePresence Server 8710, 7010 [CSCur33274]
• Cisco TelePresence Server on Multiparty Media 310, 320 [CSCur33274]
• Cisco TelePresence Server on Virtual Machine [CSCur33274]
• Cisco TelePresence Video Communication Server [CSCur23698]

Wireless

• Cisco Wireless LAN Controller (WLC) [CSCur27551]

Cisco Hosted Services

• Cisco Cloud Web Security [CSCur34051]

4. Other Vendors

Apple has released a security update at the following link:Security Update 2014-005

Asterisk has released a security advisory at the following link:AST-2014-011

BlackBerry has released a security notice at the following link: KB36397

FreeBSD has released a VuXML document at the following link: OpenSSL -- multiple vulnerabilities

Microsoft has released a security advisory at the following link: 3009008

OpenSSL has released a security advisory at the following link: secadv_20141015

Oracle has released a security advisory at the following link:Cryptographic Issues vulnerability

Red Hat has released a CVE statement and security advisories for bug ID 1152789 at the following links: CVE-2014-3566, RHSA-2014:1653, and RHSA-2014:1652

References:

a.  Check Point response to the POODLE Bites vulnerability (CVE-2014-3566)

b. Cisco Security Advisory: SSL Padding Oracle On Downgraded Legacy Encryption (POODLE) Vulnerability

Enable Checkpoint SSL VPN Remote Access: Step by Step Part 4 - Two Factor Authentication (AD and SMS)

Part 1: Enable Checkpoint SSL VPN Remote Access: Step by Step Instruction Part 1 (Local User Authentication)
Part 2: Enable Checkpoint SSL VPN Remote Access: Step by Step Instruction Part 2 (AD Authentication)
Part 3: Enable Checkpoint SSL VPN Remote Access: Step by Step Instruction Part 3 (Certs and Two Factor Authentication)
Part 4: Enable Checkpoint SSL VPN Remote Access: Step by Step Part 4 - Two Factor Authentication  (AD and SMS)


Check Point provide nice integration for Two-Factor Authentication with DynamicID, which is One Time Password.

In this lab, I choose SMS Provider HQSMS.com. It is free for signup and provide 0.30 credit for you to test SMS function, which is 10 SMS messages.

To enable two factor authentication with DynamicID for SMS is also quite straight forward.

Steps:

1. For first factor authentication, username and password has been picked, which is Active Directory account.

2. Second factor authentication is DynamicID. 

Either Global settings or Custom settings for this gateway is fine. You have to check the option to choose "Challenge users to provide the DynamicID one time password sent to their email account or mobile device via SMS."

Then You will have to fill in SMS provider or Email Settings as show in the following screenshot.

3. Add email address and Mobile Phone number into Test1 AD account

4. After the policy push to the gateway, test it with this Test1 AD account.

The first authentication is AD account username and password.

 After you sign in with your AD account, automatically gateway will send out One Time Password (verification code) request to SMS Provider.

The registered mobile phone number (+1xxxxxx9266) in Test1 AD account will receive a SMS sent from +44 7156066456:
"Mobile Access DynamicID one time password:611720"

Then verification code can be entered into next screen.

If verification code is correct, you will get into Check Point Mobile window to access allowed resources defined in the Mobile Access Blade.

Reference:

• Mobile Access Blade Configuration and Settings
• HQSMS.COM HTTPS specification 3.4 (pdf version)
• Mobile Access R77 Versions Administration Guide for User Authentication

Forwarding Checkpoint Management Server Firewall logs to an external syslog server STRM/Qradar SIEM

There are two ways to integrate STRM with Check Point Firewalls devices.

1. Using Syslog

On Check Point management station, you can follow these steps to redirect firewall logs and audit logs to the external syslog server:

a) Vi /etc/syslog.conf, on the management station, and add the following line at the end of the file:

local5.info @hostname

such as :

          local5.info @10.94.20.23

where ‘10.94.20.23’ is the IP of the syslog server (Juniper STRM).

b) if your management server is SecurePlatform - Execute ‘service syslog restart’.

c) Add this command to /etc/rc.d/init.d/cpboot:

fw log -ftnl | logger -p local5.info -t Firewall &

or 

forward audit log to external syslog server by add following command:

fw log -ftnl $FWDIR/fw.adtlog | awk 'NF' | logger -p local5.info -t Firewall_Audit &

d) reboot Checkpoint management server and configure a new log source in STRM. Deploy Changes to STRM as well. 

e) Verify:

tcpdump host 10.94.20.23

[Expert@CP-Mgmt]# tcpdump host 10.94.20.23
tcpdump: listening on Mgmt
12:54:18.534293 CP-Management.syslog > 10.94.20.23.syslog: udp 253 (DF)
12:54:18.538859 CP-Management.syslog > 10.94.20.23.syslog: udp 16 (DF)
12:54:18.539622 CP-Management.syslog > 10.94.20.23.syslog: udp 225 (DF)
12:54:18.540382 CP-Management.syslog > 10.94.20.23.syslog: udp 16 (DF)
12:54:18.541115 CP-Management.syslog > 10.94.20.23.syslog: udp 252 (DF)
12:54:18.541904 CP-Management.syslog > 10.94.20.23.syslog: udp 16 (DF)
12:54:20.536629 CP-Management.syslog > 10.94.20.23.syslog: udp 280 (DF)
12:54:20.538424 CP-Management.syslog > 10.94.20.23.syslog: udp 16 (DF)
12:54:20.539194 CP-Management.syslog > 10.94.20.23.syslog: udp 228 (DF)
12:54:20.540009 CP-Management.syslog > 10.94.20.23.syslog: udp 16 (DF)
12:54:22.539075 CP-Management.syslog > 10.94.20.23.syslog: udp 225 (DF)
12:54:22.543184 CP-Management.syslog > 10.94.20.23.syslog: udp 16 (DF)
12:54:28.540703 CP-Management.syslog > 10.94.20.23.syslog: udp 249 (DF)
12:54:28.543712 CP-Management.syslog > 10.94.20.23.syslog: udp 16 (DF)
12:54:28.544410 CP-Management.syslog > 10.94.20.23.syslog: udp 225 (DF)
12:54:28.545036 CP-Management.syslog > 10.94.20.23.syslog: udp 16 (DF)

On STRM server 10.94.20.23, you should be able to see following logs activities:

2. Using OPSEC / LEA

a. Creating an OPSEC Application Object from Servers and OPSEC tab:

In my lab, STRM_10.94.200.23 created.

Note: Communication Initialized but trust not established, it is still fine to do firewall policy push. The communication will be established by itself after STRM configuration part done.

b. Write Down and Copy Two SIC DN info for STRM configuration

One is from new created OPSEC application: STRM_10.94.200.23
CN=STRM_10.94.200.23,O=CP-Management..wtx8w4

Another is from Mgmt Server CP_Management as show below:

cn=cp_mgmt,o=CP-Management..wtx8w4

c. STRM Log Source

 d. add a new Checkpoint Firewall-1 OPSEC / LEA log Source

e. Verify SIC Connection from Checkpoint Mgmt Server OPSEC Application STRM_10.94.200.23

Reference:

1.  Juniper STRM Configuring DSMs
2.  How to send FireWall logs from Gaia-based Security Management Server to an external Syslog server
3.  Forward Logs from Checkpoint SmartCenter Management Server and Juniper NSM / IDP to Syslog Server

Enable Checkpoint SSL VPN Remote Access: Step by Step Instruction Part 3 (Certs and Two Factor Authentication)

This is the third part of Checkpoint SSL VPN Series LAB.
Part 1: Enable Checkpoint SSL VPN Remote Access: Step by Step Instruction Part 1 (Local User Authentication)
Part 2: Enable Checkpoint SSL VPN Remote Access: Step by Step Instruction Part 2 (AD Authentication)
Part 3: Enable Checkpoint SSL VPN Remote Access: Step by Step Instruction Part 3 (Certs and Two Factor Authentication)
Part 4: Enable Checkpoint SSL VPN Remote Access: Step by Step Part 4 - Two Factor Authentication  (AD and SMS)

In this part, it will introduce how to use Checkpoint Internal CA issued Certs and how to enable two factor authentication using certs and AD accounts.

In Part 2, AD authentication has been tested and next step is to create certificate for each remote user.

Enable Certificate Authentication Steps:

1. Create Certificate for user test2.

2. Click OK after enter all information for Certificate File.

3. Once certificate created, it will show in the list. It also can be revoked.

4. Import Certificate into Client Machine

Double click the cert file from Client Machine. It will enable Certificate Import Wizard. Enter your password, click next and next then it will be completed this import.

5. Change authentication method to from Username and Password to Personal Certificate on the Gateway Properties:

6. After installed polices to gateway, test it from Client Machine with your imported Personal Certificate:

Enable two factor authentication (Certs and AD account) Steps

1. Certificate will be the first method and AD username/password will be second factor. 

Here is the list Supported Authentication Schemes Combinations:

2. GuiDBedit Tool 

It will be used to configure Multiple Authentication Schemes to allow the administrator to request multiple proofs of user's identity. In our case, for example, request the user to install his certificate and enter his AD password for authenticating.

GuiDBedit Tool will be found at C:\Program Files (x86)\CheckPoint\SmartConsole\RXX\PROGRAM\GuiDBedit.exe

3. Verify the first factor authentication is Certificates.

It will be found at Tables -> Network Objects ->network_objects.
Found the Gateway / Cluster object, in this case , for example, it is R77.
From lower pane, check the value of realms_for blades-> ssl_vpn ->authentication-> auth_schemes->Element Index 0 -> auth_scheme.
It is certificate which is configured before thorough Smart Dashboard.

4. right click on 'auth_schemes' ,-> 'Add...'

5. Enter a value for Index:  

1 for the second authentication scheme. 0 is already there for 1st factor, which is 'Element Index 0'

6. Go to 'Element Index 1', right click on 'auth_scheme' -> 'Edit...'. Choose 'user_pass' for AD username and password as 2nd factor.

7. Save the changes ('File' menu - 'Save All').  

Close the GuiDBedit Tool. Connect to Security Management Server with SmartDashboard. Install the policy onto Security Gateway / Cluster object.

8. Test

Reference:

1. Multiple Authentication Schemes for Mobile Access

Enable Checkpoint SSL VPN Remote Access: Step by Step Instruction Part 2 (AD Authentication)

Part 1: Enable Checkpoint SSL VPN Remote Access: Step by Step Instruction Part 1 (Local User Authentication)
Part 2: Enable Checkpoint SSL VPN Remote Access: Step by Step Instruction Part 2 (AD Authentication)
Part 3: Enable Checkpoint SSL VPN Remote Access: Step by Step Instruction Part 3 (Certs and Two Factor Authentication)
Part 4: Enable Checkpoint SSL VPN Remote Access: Step by Step Part 4 - Two Factor Authentication  (AD and SMS)

In previous lab Part 1 "Enable Checkpoint SSL VPN Remote Access: Step by Step Instruction Part 1 (Local User Authentication)", it shows the first part how to enable Checkpoint SSL VPN with local user authentication and how to add a native application. In this second part of lab, it will show the integration with Active Directory accounts for remote ssl vpn access.

Topology: 

Steps:

1. Enable Identity Awareness Blade in Check Point gateway properties to start Identity Awareness Configuration wizard:

 2. Choose AD Query at Methods for Acquiring Identity window.

 3. Add new Active Directory

 4. Finish the configuration wizard

 5. Add AD Group into Mobile Access Policy as show in the rule No. 2.

6. Use AD account 'test' to do test 

After log in, it only shows Native Application Section to connect. If account is not defined in the any mobile access rule, the login window will show "User is unauthorized" although there is account in the AD.