Title

ColdFusion must transmit only encrypted representations of passwords to the mail server. (Cat II impact)

Discussion

Passwords need to be protected at all times, and encryption is the standard method for protecting passwords during transmission. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. ColdFusion may use username/password to connect to a mail server. When this authentication method is used, it is important that the credentials be protected when transmitted by being encrypted. While TLS encryption is the preferred method by DoD, SSL can be used when the mail server does not offer any other method of encryption.

Check Content

Within the Administrator Console, navigate to the "Mail" page under the "Server Settings" menu. If a user name and password are required for authentication and "Enable TLS connection to mail server" is unchecked and "Enable SSL socket connects to mail server" is unchecked, this is a finding.

Fix Text

Navigate to the "Mail" page under the "Server Settings" menu. Enable SSL/TLS by checking "Enable SSL socket connections to mail server" and/or "Enable TLS connection to mail server" options and select the "Submit Changes" button.

Additional Identifiers

Rule ID: SV-237193r641674_rule

Vulnerability ID: V-237193

Group Title: SRG-APP-000172-AS-000120

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.