SSL Anonymous Cipher Suites Supported

This finding means a TLS service still advertises anonymous key-exchange cipher suites such as ADH or AECDH under SSL/TLS versions up to 1.2. Those suites encrypt traffic but do not authenticate the server, so a client that negotiates them has no cryptographic proof it is talking to the right endpoint. Historically, this mapped to Apache Tomcat 4.1.28-4.1.31, 5.0.0-5.0.30, and 5.5.0-5.5.17 via CVE-2007-1858, but in practice the plugin catches a broader misconfiguration pattern on any TLS service that still offers aNULL suites.

Vendor scoring overstates the operational urgency for most enterprises. The bug is real, but exploitation usually requires man-in-the-middle position plus a client willing to negotiate anonymous suites, and modern browsers, current OpenSSL defaults, Apache mod_ssl, and TLS 1.3 all push hard against that path. For a 10,000-host environment, this is usually TLS hygiene, not an incident-response-grade patch.

Why this verdict

• Requires on-path access: the attacker usually needs LAN/Wi-Fi/gateway position before the weakness matters, which is compounding downward pressure on severity
• Requires a legacy client offer: modern browsers and current TLS libraries commonly exclude aNULL, so the exposed population is much smaller than a raw network-scannable bug suggests
• No direct host takeover: successful abuse compromises session confidentiality/authentication for intercepted traffic, but it does not by itself yield code execution or durable server compromise

Why not higher?

This is not a clean unauthenticated remote exploit against the server. The chain needs both network interception and a client willing to negotiate anonymous suites, and both assumptions fail in a lot of modern enterprise estates. That combination is too much real-world friction for HIGH or CRITICAL.

Why not lower?

It is still a genuine cryptographic exposure, especially on flat internal networks, legacy app segments, appliances, and unmanaged clients. If a compatible client exists and an attacker gets on-path, TLS server identity protection is gone. That is more than paperwork, so IGNORE is too soft.

1. Remove aNULL from cipher policy — Explicitly exclude anonymous suites at the service, proxy, or platform crypto-policy layer so the issue disappears regardless of certificate state. For a LOW finding there is no SLA — treat as backlog hygiene and fold it into the next TLS baseline update.
2. Prioritize internet-facing and shared-network services — Start with externally reachable systems, guest/shared Wi-Fi segments, and legacy internal apps where on-path interception is more plausible. For LOW, there is no mitigation SLA; clean these up during normal hardening rather than interrupting emergency patch lanes.
3. Log negotiated cipher suites — If your reverse proxy, load balancer, or web tier can log the negotiated TLS cipher, turn it on temporarily to spot any real client dependency on anonymous suites before you change policy. For LOW, do this opportunistically as part of routine crypto hygiene.
4. Reduce legacy protocol exposure — Where possible, prefer TLS 1.2/1.3-only policies and retire compatibility modes that keep old cipher negotiation alive. This is a structural cleanup task, so for LOW it belongs in normal engineering backlog, not emergency change windows.

Run this from an auditor workstation or scanner host that can reach the target TLS port directly. Invoke it as ./check_anonymous_tls.sh app.example.com 443 with no special privileges; it tests direct TLS sockets only, not STARTTLS protocols.

#!/usr/bin/env bash
# check_anonymous_tls.sh
# Detect whether a TLS service accepts anonymous cipher suites (aNULL).
# Usage: ./check_anonymous_tls.sh <host> <port>
# Exit codes: 0=VULNERABLE, 1=PATCHED, 2=UNKNOWN

set -u

HOST="${1:-}"
PORT="${2:-}"

if [[ -z "$HOST" || -z "$PORT" ]]; then
  echo "UNKNOWN - usage: $0 <host> <port>" >&2
  exit 2
fi

if ! command -v openssl >/dev/null 2>&1; then
  echo "UNKNOWN - openssl not found" >&2
  exit 2
fi

# Make sure the local OpenSSL build actually has anonymous ciphers compiled in.
if ! openssl ciphers 'aNULL:@SECLEVEL=0' >/dev/null 2>&1; then
  echo "UNKNOWN - local OpenSSL cannot test aNULL suites" >&2
  exit 2
fi

probe() {
  local proto="$1"
  local out rc
  out="$(timeout 10 openssl s_client -connect "${HOST}:${PORT}" -servername "$HOST" -cipher 'aNULL:@SECLEVEL=0' "$proto" < /dev/null 2>&1)"
  rc=$?

  # Success indicators: handshake completed and a real cipher was selected.
  if [[ $rc -eq 0 ]] && grep -Eq 'Cipher is [A-Za-z0-9_-]+' <<<"$out" && ! grep -Eq 'Cipher is \(NONE\)|no cipher match|handshake failure|no shared cipher' <<<"$out"; then
    echo "VULNERABLE - ${HOST}:${PORT} accepted anonymous cipher suite with ${proto#-}"
    return 0
  fi

  return 1
}

# Test TLS versions where anonymous suites are relevant.
for proto in -tls1 -tls1_1 -tls1_2; do
  if probe "$proto"; then
    exit 0
  fi
done

# If all probes failed cleanly, treat as patched/non-vulnerable.
echo "PATCHED - ${HOST}:${PORT} did not accept anonymous cipher suites in tested TLS modes"
exit 1

Sources

1. Tenable Nessus Plugin 31705
2. NVD CVE-2007-1858
3. Apache Tomcat 5.5 changelog
4. OpenSSL cipher string documentation
5. RFC 5246 - TLS 1.2
6. RFC 8446 - TLS 1.3
7. Apache mod_ssl documentation
8. Nmap ssl-enum-ciphers script documentation