OpenSSL 'ChangeCipherSpec' MiTM Potential Vulnerability

[pgnair]

Hi. In ServerController.SSLOptions.CipherList, try to put only SCH_USE_STRONG_CRYPTO and TLS 1.2 ciphers only. You can check on the link below, all the ciphers used in windows (and in the IW 15 http.sys version). I'm using IW 15 (http.sys) and configured on windows, only TLS 1.2 and STRONG ciphers.
Link: https://docs.microsoft.com/pt-br/windows...s-10-v1607

Thanks for the reply Jose.This is what the cipher list what I am using now as per Alexnandre. Just want to add SCH_USE_STRONG_CRYPTO at the end? SSL version what am using is TLSv12

Code:

ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:
DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:!ADH:!EXP:!RC4:!eNULL@STRENGTH

---

Current SA apps are limited to older TLS revisions as well until Indy is updated (in progress) for the newer TLS specs.

If you need newer TLS specs, consider deploying your IntraWeb application on IIS or http.sys (even easier) as they provide the SSL instead of IntraWeb (via Indy) when in SA.

Also IntraWeb 14 is now not being updated except for possibly critical issues and 15.2 is our current development tree so any updates, SSL or other will be applied to that branch not 14.

Thanks for the reply.
I have the 15.2 license also but this application is developed in 14 and it is difficult to move to it on 15 at this stage as this is a banking application and it is running smoothly. There were lots of vulnerabilities in this website and those were fixed by the help of Alexandre at that time. In the last quarter audit got few vulnerabilities and this is one of them. This application was running as a service earlier after it got crashed few times and then changed to SA and working properly in the last 2 years. Is there any other work around to resolve this issue please