核心交换机S5560X-58C-HI等保测评报中高危漏洞

CVE-2011-1473:

关闭SSL重协商

[125AF]ssl renegotiation disable

CVE-2015-2808：

建议配置规避措施，使用SSL命令关掉RC4算法

[H3C]ssl server-policy fxm

[H3C-ssl-server-policy-fxm]ci

[H3C-ssl-server-policy-fxm]ciphersuite ?  //选个非RC4的算法

  dhe_rsa_aes_128_cbc_sha  Cipher suite that uses DHE RSA, 128-bit AES_CBC, and

                           SHA

  dhe_rsa_aes_256_cbc_sha  Cipher suite that uses DHE RSA, 256-bit AES_CBC, and

                           SHA

  exp_rsa_des_cbc_sha      Export cipher suite that uses RSA, DES_CBC, and SHA

  exp_rsa_rc2_md5          Export cipher suite that uses RSA, RC2, and MD5

  exp_rsa_rc4_md5          Export cipher suite that uses RSA, RC4, and MD5

  rsa_3des_ede_cbc_sha     Cipher suite that uses RSA, 3DES_EDE_CBC, and SHA

  rsa_aes_128_cbc_sha      Cipher suite that uses RSA, 128-bit AES_CBC, and SHA

  rsa_aes_256_cbc_sha      Cipher suite that uses RSA, 256-bit AES_CBC, and SHA

  rsa_des_cbc_sha          Cipher suite that uses RSA, DES_CBC, and SHA

  rsa_rc4_128_md5          Cipher suite that uses RSA, 128-bit RC4, and MD5

  rsa_rc4_128_sha          Cipher suite that uses RSA, 128-bit RC4, and SHA

之后重启https服务

undo ip https enable

ip https enable

CVE-2014-3566：

建议关闭ssl3.0

[125AF]ssl version ssl3.0 disable 

Comware 平台参照SSL/TLS 受诫礼(BAR-MITZVAH)攻击漏洞(CVE-2015-2808)解决方法，新建ssl server policy，关闭des/3des相关的加密套件。

  升级2021年年度版本或更新版本后，参照SSL/TLS 受诫礼(BAR-MITZVAH)攻击漏洞(CVE-2015-2808)解决方法进行修复（链接如下：https://zhiliao.h3c.com/Theme/details/130547 ），其中加密套件禁用如下三种：
exp_rsa_des_cbc_sha
exp_rsa_rc2_md5
exp_rsa_rc4_md5