Enterprise Server Security: Vulnerability in Digital Certificate Authentication Service (DCAS)

Solution

Mitigations for the DCAS vulnerability are described below. Micro Focus recommends customers apply some or all of these to reduce or eliminate the possibility of the DCAS feature being abused.

• Upgrade to Enterprise Server 5.0 Patch Update 9 or later, then follow the advice in the DCAS Security documentation topic.
• DCAS is used almost exclusively for TN3270 sign-on, either using client certificates or with an external authentication server such as Host Access for Cloud. If you have DCAS enabled but do not actually need it, disable it. This eliminates the issue.
• Restrict communications access to the DCAS listener:
  • If DCAS is used only for TN3270 ELF (aka CEL):
    • Configure it to bind to localhost, by changing the endpoint in the listener configuration from e.g. "*:*" to "localhost:*". This will prevent connections to DCAS from other systems, and confine the exposure to attackers able to run DCAS clients on the system Enterprise Server is running on.
    • Alternatively (or in addition), use the Micro Focus Communication Server Conversation Filtering (firewall) feature to block all connections. When DCAS is used by ELF, the TN3270 listener submits the request directly to it, not over a network connection. So you can use a filter rule such as "deny:**" to prevent any connections to DCAS. This will eliminate the issue.
  • If DCAS must permit remote connections (e.g. for Automated Sign-on for Mainframe):
    • Use Conversation Filtering to restrict connections to IP address(es) of legitimate clients (preferred), or
    • Restrict connections by DNS name patterns if addresses aren't known.

Either of these measures will make the vulnerability more difficult to attack.

• Restrict the type of requests DCAS will allow, using the "allowed formats" configuration setting. See the documentation topic DCAS Conversation Type.
  • If you are only using DCAS for ELF, configure it to allow only Format 1 requests. This makes DCAS much more difficult to abuse.
  • If you are only using DCAS with an external security service such as Automated Sign-on for Mainframe, configure it to allow only Format 2 requests. This makes DCAS somewhat more difficult to abuse.
• If you must allow remote connections to the DCAS listener, enable TLS for it and require client certificates. Use a minimal root certificate collection, preferably a single root certificate controlled by your organization and used to sign the certificates for DCAS client systems such as HAC. This mitigation requires significant effort (due to the complications of configuring TLS and administering certificates and keys), but makes DCAS significantly more difficult to abuse.
• Restrict which users can get credentials through DCAS to those who actually need it:
  • Using the cascertreg utility (or by removing files from the certificate-mapping directory), remove certificate mappings for users who do not need certificate authentication through DCAS or CICS Web Interface.
  • If you use the MLDAP ESM Module as part of your Enterprise Server security configuration, restrict which users can use passtokens using the [Passtoken] configuration section and the per-user microfocus-MFDS-User-CreateToken and microfocus-MFDS-User-UseToken LDAP attributes.

Customers with questions about this subject should open an incident with Micro Focus Customer Care.