vulnerability CVE-2004-2761 on SQL server.

• prsnn_shetty

  Right there with Babe

  Points: 750

  More actions

  February 1, 2022 at 4:17 am

  #3979423

  Hi

  We have got few point of action for vulnerability CVE-2004-2761(SSL Certificate Signed Using Weak Hashing Algorithm)on our SQL servers.

  , OS Windows Server 2016 Standard. Please let us know how can we close this.

  Regards

  Prasanna Shetty

• Ant-Green

  SSC Guru

  Points: 113536

  More actions

  February 1, 2022 at 6:37 am

  #3979448

  Two options.

  Upgrade to SQL2017 or SQL2019

  Create your own SSL certificate trusted by a CA and put that in place instead.

  https://docs.microsoft.com/en-us/sql/database-engine/configure-windows/enable-encrypted-connections-to-the-database-engine?view=sql-server-ver15

  You don’t need to enforce encrypted connections but you need to have the certificate thumbprint in the configuration to use your cert and not the fallback cert.

• prsnn_shetty

  Right there with Babe

  Points: 750

  More actions

  February 1, 2022 at 7:22 am

  #3979451

  Thanks Ant-Green

• osca1069

  Newbie

  Points: 2

  More actions

  February 5, 2024 at 3:35 pm

  #4373632

  Hi sir, the problem is that as a practice we have be never used SSL certificate trusted by a CA in our SQL instances, what should we do in this specific case to solve the vulnerability?

  Thanks

• Ant-Green

  SSC Guru

  Points: 113536

  More actions

  February 5, 2024 at 4:10 pm

  #4373639

  osca1069 wrote:

  Hi sir, the problem is that as a practice we have be never used SSL certificate trusted by a CA in our SQL instances, what should we do in this specific case to solve the vulnerability?

  Thanks

   

  Upgrade to SQL 2019/SQL 2022.

• osca1069

  Newbie

  Points: 2

  More actions

  February 5, 2024 at 7:00 pm

  #4373752

  Hi sir, we have other SQL Server 2016 instances, why doesn't the vulnerability appear in them as well?

• Ant-Green

  SSC Guru

  Points: 113536

  More actions

  February 5, 2024 at 7:53 pm

  #4373773

  Probably not using the default fallback cert.

  But still you should be upgrading. 2016 is a dead product now in terms of MSFT.