核心交換機S5560X-58C-HI等保測評報中高危漏洞

CVE-2011-1473:

關閉SSL重協商

[125AF]ssl renegotiation disable

CVE-2015-2808：

建議配置規避措施，使用SSL命令關掉RC4算法

[H3C]ssl server-policy fxm

[H3C-ssl-server-policy-fxm]ci

[H3C-ssl-server-policy-fxm]ciphersuite ?  //選個非RC4的算法

  dhe_rsa_aes_128_cbc_sha  Cipher suite that uses DHE RSA, 128-bit AES_CBC, and

                           SHA

  dhe_rsa_aes_256_cbc_sha  Cipher suite that uses DHE RSA, 256-bit AES_CBC, and

                           SHA

  exp_rsa_des_cbc_sha      Export cipher suite that uses RSA, DES_CBC, and SHA

  exp_rsa_rc2_md5          Export cipher suite that uses RSA, RC2, and MD5

  exp_rsa_rc4_md5          Export cipher suite that uses RSA, RC4, and MD5

  rsa_3des_ede_cbc_sha     Cipher suite that uses RSA, 3DES_EDE_CBC, and SHA

  rsa_aes_128_cbc_sha      Cipher suite that uses RSA, 128-bit AES_CBC, and SHA

  rsa_aes_256_cbc_sha      Cipher suite that uses RSA, 256-bit AES_CBC, and SHA

  rsa_des_cbc_sha          Cipher suite that uses RSA, DES_CBC, and SHA

  rsa_rc4_128_md5          Cipher suite that uses RSA, 128-bit RC4, and MD5

  rsa_rc4_128_sha          Cipher suite that uses RSA, 128-bit RC4, and SHA

之後重啟https服務

undo ip https enable

ip https enable

CVE-2014-3566：

建議關閉ssl3.0

[125AF]ssl version ssl3.0 disable 

Comware 平台參照SSL/TLS 受誡禮(BAR-MITZVAH)攻擊漏洞(CVE-2015-2808)解決方法，新建ssl server policy，關閉des/3des相關的加密套件。

  升級2021年年度版本或更新版本後，參照SSL/TLS 受誡禮(BAR-MITZVAH)攻擊漏洞(CVE-2015-2808)解決方法進行修複（鏈接如下：https://zhiliao.h3c.com/Theme/details/130547 ），其中加密套件禁用如下三種：
exp_rsa_des_cbc_sha
exp_rsa_rc2_md5
exp_rsa_rc4_md5