Vulnerability Description: With a typical modern desktop PC, it is quite feasible to crack export-grade 40-bit SSL communication. Nevertheless it is considered difficult executing the mentioned attack and requires specific situations in which it can be exploited. In other cases, an attacker can manipulate clients in order to launch a classic man-in-the-middle attack, where the attacker sends specially crafted packets to the clients, manipulating their Internet Explorers causing the client to choose weak (export-grade 40-bit key) encryption algorithms, without the client (user) being aware of the attack happening. The current configuration of the web servers allows the usage of low encryption such as 40 Bit & 56 Bit and in some case NULL encryption, which does not protect the data at all.
Risk Level: Medium
With a typical modern desktop PC, it is quite feasible to crack export-grade 40-bit SSL communication. Nevertheless it is considered difficult to execute the mentioned attack due to the fact that the attack requires specific situations in which it can be exploited.
Initial Recommendations:
? Remove the support for weak ciphers (export-grade 40-bit keys).
—-
How can we implement this ??