1264186 - archive.mozilla.org SSLV3 and Other Weak Ciphers

Status: RESOLVED DUPLICATE of bug 1084577

(Websites :: Other, defect)

Description

[Sean Melia]

archive.mozilla.org is running SSLv3 which is vulnerable to POODLE. It is also using other weak ciphers like RC4-MD5 and DES-CBC3-SHA which should be disabled as well.

Reproduction command:
$ sslyze --regular archive.mozilla.org

Output:
* TLSV1_2 Cipher Suites:
      Preferred:                       
                 ECDHE-RSA-AES128-GCM-SHA256   ECDH-256 bits  128 bits      HTTP 200 OK                        
      Accepted:                        
                 ECDHE-RSA-AES256-SHA384       ECDH-256 bits  256 bits      HTTP 200 OK                        
                 ECDHE-RSA-AES256-SHA          ECDH-256 bits  256 bits      HTTP 200 OK                        
                 ECDHE-RSA-AES256-GCM-SHA384   ECDH-256 bits  256 bits      HTTP 200 OK                        
                 AES256-SHA                    -              256 bits      HTTP 200 OK                        
                 AES256-GCM-SHA384             -              256 bits      HTTP 200 OK                        
                 ECDHE-RSA-AES128-SHA256       ECDH-256 bits  128 bits      HTTP 200 OK                        
                 ECDHE-RSA-AES128-SHA          ECDH-256 bits  128 bits      HTTP 200 OK                        
                 ECDHE-RSA-AES128-GCM-SHA256   ECDH-256 bits  128 bits      HTTP 200 OK                        
                 RC4-MD5                       -              128 bits      HTTP 200 OK                        
                 AES128-SHA256                 -              128 bits      HTTP 200 OK                        
                 AES128-SHA                    -              128 bits      HTTP 200 OK                        
                 AES128-GCM-SHA256             -              128 bits      HTTP 200 OK                        
                 DES-CBC3-SHA                  -              112 bits      HTTP 200 OK                        

  * TLSV1_1 Cipher Suites:
      Preferred:                       
                 ECDHE-RSA-AES128-SHA          ECDH-256 bits  128 bits      HTTP 200 OK                        
      Accepted:                        
                 ECDHE-RSA-AES256-SHA          ECDH-256 bits  256 bits      HTTP 200 OK                        
                 AES256-SHA                    -              256 bits      HTTP 200 OK                        
                 ECDHE-RSA-AES128-SHA          ECDH-256 bits  128 bits      HTTP 200 OK                        
                 RC4-MD5                       -              128 bits      HTTP 200 OK                        
                 AES128-SHA                    -              128 bits      HTTP 200 OK                        
                 DES-CBC3-SHA                  -              112 bits      HTTP 200 OK                        

  * TLSV1 Cipher Suites:
      Preferred:                       
                 ECDHE-RSA-AES128-SHA          ECDH-256 bits  128 bits      HTTP 200 OK                        
      Accepted:                        
                 ECDHE-RSA-AES256-SHA          ECDH-256 bits  256 bits      HTTP 200 OK                        
                 AES256-SHA                    -              256 bits      HTTP 200 OK                        
                 ECDHE-RSA-AES128-SHA          ECDH-256 bits  128 bits      HTTP 200 OK                        
                 RC4-MD5                       -              128 bits      HTTP 200 OK                        
                 AES128-SHA                    -              128 bits      HTTP 200 OK                        
                 DES-CBC3-SHA                  -              112 bits      HTTP 200 OK                        

  * SSLV3 Cipher Suites:
      Preferred:                       
                 ECDHE-RSA-AES128-SHA          ECDH-256 bits  128 bits      HTTP 200 OK                        
      Accepted:                        
                 ECDHE-RSA-AES256-SHA          ECDH-256 bits  256 bits      HTTP 200 OK                        
                 AES256-SHA                    -              256 bits      HTTP 200 OK                        
                 ECDHE-RSA-AES128-SHA          ECDH-256 bits  128 bits      HTTP 200 OK                        
                 RC4-MD5                       -              128 bits      HTTP 200 OK                        
                 AES128-SHA                    -              128 bits      HTTP 200 OK                        
                 DES-CBC3-SHA                  -              112 bits      HTTP 200 OK

Comment 1

[April King [:April]]

This is specifically done so that Windows XP SP2 users can continue to access the Firefox binaries.

Comment 2

[[e-mail] (:bhearsum)]

(In reply to April King [:April] from comment #1)

This is specifically done so that Windows XP SP2 users can continue to
access the Firefox binaries.

I believe XP (SP2 and later) have been fully desupported since the ESR 52 line stopped publishing updates. Should we revisit this now?

Comment 3

[April King [:April]]

That's a good question, but not one I can answer. I think :ulfr would probably be the ideal contact here, since he's responsible for product delivery.