V-286757

Discussion

The SSL/TLS renegotiation vulnerability is a potential cyber threat in cases when a client can initiate a renegotiation process. An attacker can abuse this situation by making the server unavailable with a Denial of Service attack or can execute a Man-in-the-Middle injection attack into the HTTPS sessions. To avoid potential TLS Renegotiation Denial-of-Service attacks the Client Initiated TLS renegotiation setting must be disabled. Note: The Horizon Connection Server disables this option by default.

Check Content

1. On the Horizon Connection Server, launch the Registry Editor.

2. Traverse the registry tree to "HKEY_LOCAL_MACHINE\Software\Omnissa\Horizon\Plugins\wsnm\TunnelService\Params".

3. Locate the "JvmOptions" key.

If "JvmOptions" does not exist or the path does not exist, this is not a finding.

If "JvmOptions" exists and does not include the "-Djdk.tls.rejectClientInitiatedRenegotiation=true" option, this is a finding.