Posts Tagged iis

Disable SSL 2 on Windows Server

Posted by Le Kevin in Computer on February 5, 2010

Secure Socket Layer protocol version 2 (SSL v2) has a serious vulnerability. Successful exploitation of this vulnerability would allow an attacker to execute arbitrary code in the context of the affected server. No authentication is required to reach the vulnerable code. No user interaction is required. Since this vulnerability is in library code used by multiple applications, the details of how an attacker would exploit it vary. In all cases, an attacker would need to specify invalid parameters as part of the SSLv2 handshake.  Common Vulnerabilities and Exposures (CVE) classified the vulnerability under CVE-2004-0120. Microsoft identified such vulnerabilities in its security bulletin MS04-011 but until today the default configuration for Windows 2000 and Windows 2003 has SSL v2.0 protocol enabled.
To disable SSL V2 protocol:
1.
Click Start, click Run, type regedt32 or type regedit, and then click OK.
2.

In Registry Editor, locate the following registry key:

HKey_Local_Machine\System\CurrentControlSet\Control\SecurityProviders \SCHANNEL\Protocols\SSL 2.0\Server
3.
On the Edit menu, click Add Value.
4.
In the Data Type list, click DWORD.
5.

In the Value Name box, type Enabled, and then click OK.

Note If this value is present, double-click the value to edit its current value.
6.
Type 00000000 in Binary Editor to set the value of the new key equal to “0″.
7.
Click OK

sources: http://support.microsoft.com/kb/187498

testing ssl: http://foundeo.com/products/iis-weak-ssl-ciphers/test.cfm

Share|

, , , , ,

No Comments

Abyss Web Server – a free/great IIS subtitution

Posted by Le Kevin in Database on September 2, 2008

Abyss Web Server is a compact web server available for Windows, Mac OS X, Linux, and FreeBSD operating systems.

Despite its small footprint, it supports HTTP/1.1, secure SSL/TLS connections (HTTPS), dynamic content generation through CGI/FastCGI scripts, ISAPI extensions, native ASP.NET support, Server Side Includes (SSI), custom error pages, password protection, IP address control, anti-leeching, and bandwidth throttling.

It also features an automatic antihacking system as well as a multilingual remote web management interface that makes its configuration as easy as browsing a web site.

http://www.aprelium.com/abyssws/

Share|

,

No Comments