Vulnerability Report-24600

Issue: Weak TLS Cipher Suite / Deprecated TLS Version (TLS 1.1)

Severity: Low

Protocol/Port: SSL / TCP 443

Affected Host:

anarax.hd.free.fr:443

🔎 What This Means

The server supports TLS 1.1 and allows the use of the cipher suite
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA.

TLS 1.1 is considered deprecated and no longer recommended for secure communications. Cipher suites using CBC mode and SHA‑1 are weaker compared to modern AEAD-based ciphers (such as AES‑GCM or ChaCha20‑Poly1305).

While exploitation is not trivial, continued support for deprecated protocols and weak cipher suites increases the attack surface and may allow downgrade or cryptographic attacks against legacy clients.

🧪 Steps to Reproduce

Scan the target host for supported SSL/TLS protocols and cipher suites.

Using OpenSSL:

openssl s_client -connect anarax.hd.free.fr:443 -tls1_1

Observe that the server successfully negotiates TLS 1.1 with the following cipher:

TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA

This confirms that TLS 1.1 and weak cipher suites are enabled.

✅ Recommendations

Disable support for TLS 1.0 and TLS 1.1 on the server.

Enforce TLS 1.2 and TLS 1.3 only.

Remove CBC‑based and SHA‑1 cipher suites.

Prefer strong modern ciphers such as:

TLS_AES_128_GCM_SHA256

TLS_AES_256_GCM_SHA384

TLS_CHACHA20_POLY1305_SHA256

Test the configuration using tools like SSL Labs after applying changes.

📚 References

OWASP Transport Layer Protection Cheat Sheet
https://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Protection_Cheat_Sheet.html

NIST Cryptographic Standards and Guidelines
https://csrc.nist.gov/projects/cryptographic-standards-and-guidelines

SSL Labs – SSL/TLS Deployment Best Practices
https://github.com/ssllabs/research/wiki/SSL-and-TLS-Deployment-Best-Practices