SUMMARY

AFFECTED PRODUCTS 

The following products are vulnerable for the interfaces listed:

ADDITIONAL PRODUCT INFORMATION 

The Symantec HSM Agent for the Luna SP is not vulnerable to Sweet32, but the underlying Apache Tomcat server on the SafeNet LunaSP3 may be vulnerable.  Customers should contact SafeNet for more information about Sweet32.

The following products are not vulnerable:
Android Mobile Agent
AuthConnector
Cloud Data Protection for Oracle Sales Cloud
General Auth Connector Login Application
K9
ProxyAV ConLog and ConLogXP
Symantec HSM Agent for the Luna SP
Unified Agent
Web Isolation
WSS Agent

Symantec no longer provides vulnerability information for the following products:

Blue Coat DLP
Please, contact Digital Guardian technical support regarding vulnerability information for DLP.

ISSUES

Symantec products that support DES, 3DES, or Blowfish block symmetric encryption ciphers in long-lived SSL/TLS, SSH, and VPN connections are vulnerable to the Sweet32 birthday attack.  CVE-2016-6329 identifies the Sweet32 attack against OpenVPN implementations that use the Blowfish cipher.  CVE-2016-2183 identifies the Sweet32 attack against SSL/TLS, SSH, and other VPN implementations that use the DES and 3DES ciphers.

Block symmetric encryption ciphers have a limit on the number of blocks of plaintext that can be securely encrypted with the same key.  This limit stems from the "birthday paradox" and is known as the birthday bound.  The birthday bound depends on the cipher block size and is 2N/2 blocks for a cipher with block size N and a cipher mode such as CBC.  If two communicating parties encrypt plaintext with the same key and reach the birthday bound, there is a significant probability for ciphertext collisions, where two different plaintexts are encrypted to the same ciphertext. When the CBC block cipher mode is used, each ciphertext collision reveals the XOR of the two plaintexts that were encrypted.

The DES, 3DES, and Blowfish encryption ciphers use block size of 64 bits.  It is sufficient to encrypt 32GB of plaintext with the same key to reach the birthday bound.  The SSL/TLS, SSH, and VPN protocols support encryption with 64-bit block ciphers in CBC mode and do not renegotiate encryption keys within the same secure session.  If two communicating parties exchange a sufficient amount of data over a long-lived SSL/TLS, SSH, or VPN session, a man-in-the-middle (MITM) attacker can obtain XORs of pairs of plaintext.  If the attacker can control or guess one of the plaintexts, they can obtain the other plaintext without knowing the secret encryption key.

MITIGATION

<SSL>
client.connection.negotiated_cipher=list-of_DES_and_DES-CBC3_ciphers deny
<SSL>
server.connection.negotiated_cipher=list_of_DES_and_DES-CBC3_ciphers deny

#(config) management-services
#(config management-services) edit HTTPS-Console
#(config HTTPS-Console) attribute cipher-suite list_excluding_DES_and_DES-CBC3_cipher_suites
#(config HTTPS-Console) exit
#(config management-services) exit
#(config) ssl
#(config ssl) edit ssl-device-profile profile_name
#(config device-profile profile_name) cipher-suite list_excluding_DES_and_DES-CBC3_cipher_suites
#(config device-profile profile_name) exit
#(config ssl) exit

Ciphers aes256-ctr,aes192-ctr,aes128-ctr

sys set useStrongCiphers 1

pc setup ssl strength strong

#(config) ssh-console
#(config ssh-console) ciphers remove 3des-cbc
#(config ssh-console) ciphers remove blowfish-cbc
#(config ssh-console) exit
#(config) management-services
#(config management-services) edit HTTPS-Console
#(config HTTPS-Console) attribute cipher-suite
<select_list_excluding_DES_and_DES-CBC3_cipher_suites>
#(config HTTPS-Console) exit
#(config management-services) exit
#(config) proxy-services
#(config proxy-services) edit service_name
#(config service_name) attribute cipher-suite
<select_list_excluding_DES_and_DES-CBC3_cipher_suites>
#(config service_name) exit
#(config proxy-services) exit
#(config) ssl
#(config ssl) edit ssl-device-profile profile_name
#(config device-profile profile_name) cipher-suite
<select_list_excluding_DES_and_DES-CBC3_cipher_suites>
#(config device-profile profile_name) exit
#(config ssl) exit

<SSL>
client.connection.negotiated_cipher=list_of_DES_and_DES-CBC3_cipher_suites deny
<SSL>
server.connection.negotiated_cipher=list_of_DES_and_DES-CBC3_cipher_suites deny

protocols = {
  http = {
    ssl = {
      ...
      cipher_list="!DES:!3DES"
      ...
    } # ssl
  } # http
}

Reporter> enable
Admin password:
Reporter# stop-reporter
Are you sure you want to stop Reporter (this could take several minutes - or more)? [y/N] y
..............................bcreporter stop/waiting
Reporter# configure edit preferences.cfg
<edit preferences.cfg in text editor>
"settings/preferences.cfg" 193 lines, 4960 characters written
Changes to preferences.cfg:
32a33
>         cipher_list = "!DES:!3DES"
Reporter# configure commit preferences.cfg
Reporter# start-reporter
Starting Reporter will discard any uncommitted configuration file changes you have made.
Are you sure you want to start Reporter? [y/N] y
Reporter starting..........

REFERENCES

Sweet32: Birthday attacks on 64-bit block ciphers in TLS and OpenVPN - https://sweet32.info

REVISION

2022-02-16 A fix for Reporter 10.5 will not be provided.  Please upgrade to a later version with the vulnerability fixes. 
2021-08-27 Unified Agent is not vulnerable.
2021-08-18 WSS Agent is not vulnerable.
2021-07-13 A fix for Security Analytics 7.2 will not be provided.  Please upgrade to a later version with the vulnerability fixes.
2021-02-17 A fix for CA 2.3 will not be provided. Please upgrade to a later version with the vulnerability fixes.
2020-11-16 A fix for MTD 1.1 will not be provided.  Please upgrade to a version of CAS and SMG with the vulnerability fixes. A fix for SA 7.3 and 8.0 will not be provided.  Please upgrade to a later version with the vulnerability fixes.  A fix for XOS 9.7, 10.0, and 11.0 will not be provided.  A fix for Director 6.1 will not be provided. Please upgrade to a version of MC with the vulnerability fixes.  A fix for Reporter 10.4 will not be provided.  Please upgrade to a later version with the vulnerability fixes. 
2020-06-03 Security Analytics 7.2, 7.3, 8.0, and 8.1 are vulnerable.
2020-04-30 Fixes for ProxySG 6.5 will not be provided. Please upgrade to a later version with the vulnerability fixes.
2020-04-27 ASG 7.1 and later may enable vulnerable ciphers for the SSH management console, HTTPS management console, SSL forward proxy, SSL reverse proxy, and SSL device profiles. See Mitigation section for instructions to disable the vulnerable ciphers for all interfaces. Reporter 10.5 enables 3DES for LDAPS client connections. A fix will not be provided for Reporter 10.3. Please upgrade to a later version with the vulnerability fixes.
2020-04-04 A fix for PacketShaper S-Series will not be provided.  Allot Secure Services Gateway (SSG) is a replacement product for PacketShaper S-Series.  Please switch to a version of SSG with the vulnerability fixes. A fix for PolicyCenter S-Series will not be provided.  Allot NetXplorer is a replacement product for PolicyCenter S-Series.  Please switch to a version of NetXplorer with the vulnerability fixes.
2020-01-19 A fix for SSL connectios to Symantec will not be provided.  Please upgrade to a version of Content Analysis with the vulnerability fixes.
2019-10-03 Web Isolation is not vulnerable.
2019-09-27 A fix for ASG 6.7 is available in 6.7.4.9. CA 2.4 is not vulnerable because a fix is available in 2.4.1.1.
2019-08-24 Reporter 10.3 and 10.4 enable 3DES for LDAPS client connections.
2019-08-20 A fix for IntelligenceCenter (IC) 3.3 and IntelligenceCenter Data Collector (DC) 3.3 will not be provided. NetDialog NetX is a replacement product for IntelligenceCenter. Please switch to a version of NetX with the vulnerability fixes.
2019-08-08 A fix for Reporter 9.5 will not be provided. Please upgrade to a later version with the vulnerability fixes.
2019-08-07 A fix for ASG 6.6 and ProxySG 6.6 will not be provided. Please upgrade to a later version with the vulnerability fixes.
2019-08-06 A fix for Reporter 10.1 and 10.2 will not be provided. Please upgrade to a later version with the vulnerability fixes.
2019-01-11 A fix for connections to Symantec MA, and Lastline will not be provided.  Please upgrade to a later version with the vulnerability fixes.
2018-09-24 A fix for SSLV 3.8.4FC will not be provided.  Please upgrade to a later version with the vulnerability fixes.
2018-07-28 A fix for MA 4.2 management CLI is available in 4.2.11.
2018-07-23 A fix to disable 3DES for the SSH management console in CacheFlow is available in 3.4.2.9.
2018-04-22 Reporter 10.2 enables 3DES for LDAPS client connections.
2018-04-06 A fix to disable 3DES for SMTP alerts in SSLV 3.9 is available in 3.9.7.1.
2017-11-16 A fix for PS S-Series 11.5, 11.7, and 11.8 will not be provided.  Please upgrade to a later version with the vulnerability fixes.
2017-11-16 A fix for SSLV 3.9 will not be provided.  Please upgrade to a later version with the vulnerability fixes.
2017-11-15 SSLV 3.12 is not vulnerable because a fix is available in 3.12.1.1.
2017-11-13 PS S-Series 11.8 and 11.9 enable 3DES for SSL connections to Blue Coat and LDAPS connections to PolicyCenter S-Series.  3DES cannot be disabled for those interfaces.  PS S-Series 11.8 and 11.9 disable 3DES by default for the web UI.  See Workarounds section for instructions to ensure that 3DES is disabled for the web UI.
2017-11-08 CAS 2.2 enables 3DES for SSL connections to Blue Coat, Malware Analysis, and Lastline.  It disables 3DES by default for the secure ICAP server. 
2017-11-06 ASG 6.7 disables 3DES and Blowfish by default for the SSH management console.  It also disables 3DES by default for the HTTPS management console, SSL reverse proxy, and SSL device profiles.  ASG 6.7 also enables DES and 3DES by default for the SSL forward proxy.  See Workarounds section for instructions to disable the insecure ciphers for these interfaces.  ASG 6.7 also enables 3DES by default for connections to Blue Coat, Malware Analysis, and Lastline.  3DES cannot be disabled.
2017-08-03 SSLV 4.1 is not vulnerable because a fix is available in 4.1.1.1.
2017-07-27 3DES is disabled for the Reporter 9.5 HTTPS management console in 9.5.3.5.
2017-07-23 MC 1.10 is not vulnerable because a fix is available in 1.10.1.1.  A fix for MC 1.9 will not be provided.  Please upgrade to a later version with the vulnerability fixes.
2017-07-18 Reporter 10.1 also enables 3DES for the FTPS server.  3DES cannot be disabled.
2017-07-13 Reporter 9.4 and 9.5 enable 3DES for the HTTPS management console and LDAPS client connections.  3DES can be disabled for both interfaces.  See Workarounds section for instructions.  Reporter 10.1 enables 3DES for the HTTPS management console and LDAPS client connections.  Reporter 10.1 prior to 10.1.5.4 also enables 3DES for the SSH management CLI and SSL connections to Blue Coat.  3DES cannot be disabled.
2017-07-10 A fix for SSLV 3.11 is available in 3.11.4.1.
2017-06-27 It was previously reported that SSLV 3.9 (3.9.7.1 and later), 3.10 (3.10.2.1 and later), 3.11, and 4.0 do not enable 3DES for Host Categorization database downloads.  Further investigation indicates that SSLV 3.9, 3.10, 3.11, and 4.0 enable 3DES for Host Categorization.
2017-06-20 Added CVE-2016-6329 to Security Advisory.
2017-05-29 UA 4.8 is not vulnerable because a fix is available in 4.8.0.
2017-05-18 CAS 2.1 enables 3DES for SSL connections to Blue Coat, Malware Analysis, and Lastline.  It disables 3DES by default for the secure ICAP server.  CDP-SFDC 4.12, CDP-SNOW 4.12, CDP-COMMSVR 4.12, and CDP-INTSVR 4.12 disable 3DES by default for all SSL interfaces on newly initialized systems.
2017-03-30 MC 1.9 enables 3DES for SSL connections to Blue Coat.
2017-03-16 A fix for SSLV 3.10 is available in 3.10.2.1.
2017-03-08 ProxySG 6.7.1.1 disables 3DES and Blowfish by default for the SSH management console.  It also disables 3DES by default for the HTTPS management console, HTTPS reverse proxy, and SSL device profiles.  The algorithms are disabled only for newly initialized systems - see Workarounds section for instructions to ensure that 3DES and Blowfish are disabled after a software upgrade.
2017-03-08 MC 1.8 enables 3DES for the management CLI, SSH failover connections, and SSL connections to Blue Coat.  SSLV 4.0 enables 3DES for SSL connections to Blue Coat.  3DES cannot be disabled.
2017-01-13 A fix in SSLV 3.9 is available in 3.9.7.1.
2016-12-23 SSLV 3.11 is not vulnerable because the fixes are available in 3.11.1.1.
2016-12-22 initial public release