title: Tomcat TLS Vulnerability Sweet32 Birthday attack
body: <p>I have a tomcat service, which doesn't pas a veracode scan. Birthday attacks against TLS ciphers discovered vulnerabilities in Tomcat HTTPS port (8543).</p>
  
  <p>After reading some documentation I found following inormation:</p>
  
  <blockquote>
    <p>Found on Tomcat HTTPS (port 8543) </p>
    
    <p>Legacy block ciphers having block size of 64 bits are vulnerable to a
    practical collision attack when used in CBC mode.  All versions of
    SSL/TLS protocol support cipher suites which use DES or 3DES as the
    symmetric encryption cipher are affected. </p>
    
    <p>Remote attackers can obtain cleartext data via a birthday attack
    against a long-duration encrypted session.</p>
  </blockquote>
  
  <p>In a terminal following commands can be executed to test if tomcat is vulnerable for Sweet32 birthday attack.
  The following openssl commands can be used to do a manual test: </p>
  
  <ul>
  <li>openssl s_client -connect localhost:8543 -cipher "DES:3DES" -tls1_2</li>
  <li>openssl s_client -connect localhost:8543 -cipher "DES:3DES" -tls1_1</li>
  <li>openssl s_client -connect localhost:8543 -cipher "DES:3DES" -tls1</li>
  <li>openssl s_client -connect localhost:8543 -cipher "DES:3DES" -ssl3</li>
  <li>openssl s_client -connect localhost:8543 -cipher "DES:3DES" -ssl2</li>
  </ul>
  
  <p>The problem is that I don't have any idea where to block this vulnerability.
  Can someone help me?</p>