Mailing-List: contact users-help@tomcat.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Tomcat Users List" <users@tomcat.apache.org>
Received-SPF: neutral (nike.apache.org: local policy)
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
  s=s1024; d=yahoo.co.in;
  h=Message-ID:X-YMail-OSG:Received:X-Mailer:Date:From:Subject:To:MIME-Version:Content-Type;
  b=YMLuGQFA5liIteEv3OW8JYbYpUrSfbwPZHDh2TiPEsrb9fbMk8+l0kbLS1qVaTPOVdc3RcSfX1LcbmHge/lZj0j+r9cQcmVSu+dYy7D0pz8A88uguqr4rM6QR+hCKB1WyfBAbqT2mlrjlX6lNuUW3xQq6Zcjs3uS+6bQzXuIVA8=;
Message-ID: <845387.55638.qm@web94903.mail.in2.yahoo.com>
Date: Tue, 4 Aug 2009 12:39:23 +0530 (IST)
From: sunil chandran <sunilonweb2002@yahoo.co.in>
Subject: avoiding ssl vulnerabilities in tomcat
To: users@tomcat.apache.org
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="0-399124264-1249369763=:55638"

--0-399124264-1249369763=:55638
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: quoted-printable

Hello all,
=A0
there are some vulnerability existing on my server:
=A0
SSL Server Allows Cleartext Communication Vulnerability=20
=A0
soultion provided by the team was:
=A0
SOLUTION:=20
Disable support for anonymous authentication.
=A0
SOLUTION:=20
Disable ciphers which support cleartext communication.
=A0
These vulnerabilities still exist on my server as the modifications done on=
 the configuration file=A0ssl.conf was meant for httpd service which is not=
 being used in my server.
Ports 443 & 8443 where the vulnerabilities were detected are used by the To=
mcat service running on=A0my server.
=A0
Can someone help me identify the place in server.xml file to avoid these vu=
lnerabilties.
=A0
regards
Sunil C
=A0
=A0=0A=0A=0A      See the Web&#39;s breaking stories, chosen by people like=
 you. Check out Yahoo! Buzz. http://in.buzz.yahoo.com/
--0-399124264-1249369763=:55638--