Gaia Portal cannot load showing ERR_SSL_VERSION_OR_CIPHER_MISMATCH error in the browser

Product

All

Version

R75.40 (EOS), R75.40VS (EOS), R75.45 (EOS), R75.46 (EOS), R75.47 (EOS), R76 (EOS), R77 (EOS), R77.10 (EOS), R77.20 (EOS)

OS

Gaia

Platform

All

Last Modified

2018-03-12

Symptoms

• Vulnerability scan shows that machine running Gaia OS is vulnerable to CVE-2013-2566 - SSL RC4 Cipher Suites are supported by Gaia Portal.
• Web browsers with disabled RC4 cipher are not able to connect to Gaia Portal.

Example from Google Chrome browser when connecting to Gaia Portal:

This site can't provide a secure connection
X.X.X.X uses an unsupported protocol.
ERR_SSL_VERSION_OR_CIPHER_MISMATCH

And when clicking on DETAILS:

Unsupported protocol
The client and server don't support a common SSL protocol version or cipher suite.
This is likely to be caused when the server needs RC4, which is no longer considered secure.

Cause

1. The CRIME attack requires executing attacker agent component inside the victim's web browser.

Attack may be mitigated by disabling SSL/TLS compression in the web browser or a on the web server.

All web browsers' vendors have released versions that disable SSL/TLS compression. Therefore, this vulnerability is not relevant today.

Some vulnerability scanners may report Gaia Portal to be vulnerable to CVE-2012-4929 / CVE-2012-4930 / CVE-2013-2566.

However, since this attack requires a non-patched browser, and all browsers are patched today, such reports are false positive.

2. Web browser vendors deprecate the use of RC4 Cipher Suites based on RFC 7465 - Prohibiting RC4 Cipher Suites:

Solution

We're here for you

Please log in / sign in to view solution

Article Properties

Access Level: Advanced
Status: Approved
Date Created: 2013-07-05
Last Modified: 2018-03-12