VAMI must force clients to select the most secure cipher.
An XCCDF Rule
Description
<VulnDiscussion>During a Transport Layer Security (TLS) session negotiation, when choosing a cipher during a handshake, normally the client's preference is used. This is potentially problematic as a malicious, dated, or poorly configured client could select the most insecure cipher offered by the server, even if it supports stronger ones. If "ssl.honor-cipher-order" is enabled, the "ssl.cipher-list" setting will be treated as an ordered list of cipher values from most preferred to least, left to right.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>
- ID
- SV-256669r888529_rule
- Severity
- Medium
- References
- Updated
Remediation - Manual Procedure
Navigate to and open:
/opt/vmware/etc/lighttpd/lighttpd.conf
Add or reconfigure the following setting: