FREAK vulnerability CVE-2015-0204 reported with VSMs.

Document ID : KB000095402
Last Modified Date : 30/07/2018
Show Technical Document Details
Issue:
FREAK vulnerability CVE-2015-0204 reported with some VSMs.

SSL Server Allows Anonymous Authentication Vulnerability port nnnn/tcp over SSL 
QID: 38142 

We can test if a VSM is vulnerable by using an OpenSSL command: 
openssl s_client -connect TARGET_IP:PORT_NUMBER -cipher aNULL
 
If the connection is established, that means the service is vulnerable.
If the result is an SSL handshake error similar to the example below, the service is not vulnerable:
-----[example]-----
CONNECTED(00000003)
9216:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:226:
-----[/example]-----
Environment:
DevTest on release 10.1.
Resolution:
In the VSE Server, edit the local.properties file and add the following property: 
lisa.server.https.cipher.suites=TLS_DHE_RSA_WITH_AES_128_CBC_SHA,TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_128_GCM_SHA256
Restart the VSE Service.
Additional Information:

How is QID 38142 - SSL Server Allows Anonymous Authentication Vulnerability detected? - https://community.qualys.com/docs/DOC-1097