CODEWITHSUNDEEP
tibco
cvacca
cvacca

Reputation: 1946

How to protect Tibco BW against POODLE attack? (SSL 3.0 Protocol Vulnerability)

In order to protect Tibco BW from a POODLE attack, how can SSL v3.0 be disabled on its web server component (used in web services, http listener, etc) so that clients are only able to connect using TLS?

Upvotes: 0

Views: 1974

Answers (1)

nochum
nochum

Reputation: 795

In your question you have not shared which version of TIBCO BusinessWorks you are using. However TIBCO has released hotfix patches to address the issue. The following is from the Release Notes of TIBCO Runtime Agent 5.9.0 Hotfix 4:

Closed Issues in 5.9.0_HF-004 (This Release)

TCRT-56

To protect from the POODLE SSLv3 vulnerability (CVE-2014-3566), the SSLv3 protocol is no longer supported for TLS/SSL connections. Only version 1.0 or higher of TLS is supported.

For backward compatibility with software that supports only SSLv3, you can enable the SSLv3 protocol by setting the following system-wide properties for client-side and server-side connections in the .tra file: java.property.com.tibco.security.ssl.client.EnableSSLv3=true java.property.com.tibco.security.ssl.server.EnableSSLv3=true

Upvotes: 2

Related Questions