End-server vulnerabilities are caused by improper SSL protocol configuration in a domain server. Here is a list of vulnerabilities you should look out for:
1. BEAST
Browser Exploit Against SSL/TLS (BEAST) is a browser exploitation affecting the Secure Sockets Layer (SSL) or the Transport Layer Security (TLS) protocol by weakening cipher block chaining (CBC).
Impact
The impacts of a BEAST vulnerability can range from hijacking sessions to data breaches and encryption-related issues.
Solution
To protect against this vulnerability, the following measures can be taken:
2. POODLE
The Padding Oracle On Downgraded Legacy Encryption (POODLE) vulnerability impacts TLS implementations that don't ensure the proper structure of the padding used in the TLS packets.
Impact
A POODLE vulnerability can open the door for man-in-the-middle (MITM) attacks and session hijackings.
Solution
To avoid this vulnerability, you can:
1. Avoid using SSL v3 and lower protocols.
2. Avoid using insecure cipher suites.
3. POODLE (TLS)
POODLE (TLS) is a protocol downgrade that allows exploits on an outdated form of encryption.
If an attacker uses a man-in-the-middle attack to take control of a router at a public hot spot, they can force the user's browser to downgrade to SSL 3.0 (an older protocol) instead of using the much more modern TLS, and can then hijack the user's browser sessions.
Impact
This vulnerability can cause man-in-the-middle attacks, and dispatching spoof packets between a user and a website to force a protocol downgrade.
Solution
To avoid this vulnerability, you can:
1. Disable support for CBC encryption ciphers.
2. Enable the TLS v1.3 protocol.
4. Renegotiation Vulnerability
In this vulnerability, SSL and TLS protocols allow renegotiation requests that may enable an attacker to inject plain text into an application's protocol stream. This can result in a situation where an attacker can issue commands to the server, posing them as a request coming from a legitimate source.
Impact
This vulnerability can cause session hijackings, plain text command injections, and MITM attacks.
Solution
To avoid this vulnerability, you can:
1. Avoid SSL v3 and lower protocols.
2. Use TLS v 1.2 and higher versions.
5. ROBOT
The Return Of Bleichenbacher's Oracle Threat, or ROBOT vulnerability, affects web servers that are configured to use the Rivest–Shamir–Adleman (RSA) encryption key exchange. A hacker can recover the session key used for various sessions by exploiting the vulnerability and can decrypt communications to and from the webserver.
Impact
The impacts of the vulnerability can vary from MITM attacks, recording traffic, and decryption to extracting data.
Solution
To avoid issues arising due to this vulnerability, you can:
1. Avoid using RSA ciphers.
2. Avoid using older protocols.
6. RC4 vulnerability
The Rivest Cipher 4 (RC 4) vulnerability is an attack against TLS that allows an attacker to recover a restricted amount of plain text from a TLS connection when RC4 encryption is used. The issues in the keystream generated by the RC4 algorithm, which becomes evident in TLS ciphertexts when the same text is frequently encrypted, making it prone to attacks.
Impact
The RC4 vulnerability can enable attackers to capture network traffic, decrypt messages from those networks, and access related cookies.
Solution
To steer clear of this type of vulnerability, you can:
1. Avoid RC ciphers
2. Avoid using SSLv3 protocol and lower versions.
7. CBC vulnerability
A vulnerability exists in Secure Shell (SSH) messages that employ CBC mode, which may allow an attacker to recover the plain text from a block of ciphertext. CBC ciphers are less secure ciphers.
Impact
This vulnerability may lead to the POODLE vulnerability.
Solution:
To prevent this kind of vulnerability, you can:
1. Avoid using CBC ciphers.
2. Avoid using TLSv1.1 and lower protocols.
8. AEAD
Authenticated Encryption with Additional Data (AEAD) implies that a built-in message authentication code is present for checking the integrity of the ciphertext and the additional authenticated data. The AEAD cipher suites in TLS are the ones using AES-GCM and ChaCha20-Poly1305 algorithms.
It is true that algorithms are the most secure options, and indeed the only options that will be that will support TLS v1.3.AEAD.
Impact
This vulnerability can cause many security issues. To avoid them, you can:
1. Avoid insecure ciphers.
2. Use AEAD ciphers for security.
9. Forward secrecy
Forward secrecy (FS) is a feature of a specific key-agreement protocol that assures that even if the private key of the server is compromised, session keys will not be hampered. If forward secrecy is used, encrypted communications or sessions recorded in the past cannot be retrieved and decrypted.
Impact
This vulnerability can cause session hijackings and breach of secure authentication.
Solution
To avoid this vulnerability you can:
1. Avoid using insecure ciphers.
2. Avoid using older protocols.
3. Use Elliptic-curve Diffie–Hellman (ECDH) ciphers for secure authentication and maintaining sessions.
10. FREAK vulnerability
The Factoring RSA Export Keys (FREAK) vulnerability allows an attacker to view the transaction between a client and a server, thereby encroaching into a secure and private communication. The vulnerability occurs primarily due to a bug in the OpenSSL client software. This can put both clients and servers at risk.
Impact
This type of vulnerability can affect a large number of browser-trusted sites, embedded systems, and software products that use TLS, all without disabling the cryptographic suites.
Solution
To avoid this vulnerability, you can:
1. Avoid using export ciphers.
2. Avoid using lower protocol versions.
11. DROWN
Decrypting RSA with Obsolete and Weakened eNcryption (DROWN) is a severe vulnerability that impacts HTTPS and other services that rely on SSL and TLS, the essential cryptography protocols for internet security. This vulnerability leads to attackers breaking the encryption, and reading or stealing sensitive communication information like passwords, credit card numbers, trade secrets, or financial data.
Impact
This vulnerability can lead to MITM attacks, and can enable attackers to steal user-related details like name, password, etc.
Solution
To avoid this vulnerability, you can:
1. Avoid using SSL v2.
2. Avoid using insecure cipher suites.
12. Logjam vulnerability
The Logjam vulnerability has been found to affect most common communication encryption services like TLS, IP security (IPsec), and SSH. It helps a man-in-the-middle attacker to downgrade the secure connection to 512-bit export-grade cryptography, which can be used to view and edit securely encrypted data.
Connections over vulnerable TLS protocols are more prone to this vulnerability.
Impact
Solution
To avoid this vulnerability, you can:
1. Avoid using export ciphers.
2. Avoid using DH encryption ciphers.
3. Avoid using older versions of protocols.
13. Heartbleed
Sensitive data, including user authentication credentials and secret keys, can be exposed by a remote attacker through incorrect memory handling in the TLS heartbeat extension.
Impact
This vulnerability can lead to man-in-the-middle attacks and session hijackings, and can result in the exposure of user credentials.
Solution
To avoid this vulnerability, you can:
1. Avoid using insecure ciphers.
2. Avoid using lower versions of protocols.
3. Avoid using older OpenSSL versions.
14. Fallback SCSV
Fallback Signaling Cipher Suite Value (SCSV) prevents SSL/TLS protocol downgrades, as well as man-in-the-middle attacks.
15. CHACHA20
ChaCha [CHACHA] is a stream cipher that operates on a state of 16 32-bit words that are initialized from the input words. It consists of 20 rounds that alternate between "column" rounds and "diagonal" rounds.
ChaCha provides better security and is also immune to most SSL attacks.
16. Self-signed certificate
A self-signed certificate is one signed by the certifying entity itself. In technical terms, it is a certificate signed with its own private key.
These certificates are not trusted by other applications or operating systems, and might lead to authentications errors.
17. SSL Blacklist
The SSL Blacklist, or SSLBL, relies on IP addresses and SHA-1 fingerprints associated with certain cyberthreats. Users can access various pieces of information on each certificate, including its common name, the name of the issuer, the SSL version, associated malware binaries, and the reason for which it has been blacklisted.
18. Insecure key SSL:
Public key authentication with SSH is more secure than password authentication, as it provides a stronger identity screening. Both the private key and the correct passphrase must be present to authenticate itself.
A revocation error occurs when Windows is unable to connect to a security certificate's revocation server. In case of a revocation error, the user should check the expiry date of the certificate; if the date is expired, then the user must report it to the admin of the website.
How does it happen?
A certificate can be revoked if the private key of the user is compromised, or due to an anomaly in the issuance of the certificate.
20. Chain not valid:
A "certificate not trusted" error arises when the certificate installation is not properly completed on the server (or servers) hosting the site.
Causes
Solution
To avoid this vulnerability, you can:
1. Avoid using self-signed certificates.
2. Avoid using a free SSL certificate.
21. Common name mismatch
This error occurs when the common name or SAN of your SSL/TLS certificate doesn't match the domain or address bar in the browser. This can happen when you visit, for example, https://example.com instead of https://www.example.com, without listing both sites in the SAN of the certificate.
Causes
1. The website address isn't in your common name.
2. The website does not have an SSL but shares it with another site.
3. Misconfigurations of your server or firewall.
Impact
The website and the certificate may not load, and the connection may not be secure.