Forum Discussion

Nimbostratus

Mar 04, 2015

Solved

iRule to mitigate TLS/SSL FREAK?

In before the crowd: Please respond if you have an iRule to mitigate the FREAK attack on TLS/SSL via RSA-EXPORT. (CVE-2015-0204 on OpenSSL, see also https://www.smacktls.com/freak and http://blog.cry...

Lee_Payne_53457
Mar 04, 2015
Depending on the version of TMOS you're running you may not need to do anything, but I would disable it in the SSL profile rather than an iRule, these items should prevent it (I think): !MD5:!EXP:!EXPORT40

This article talks about disabling ciphers on the management plane: https://devcentral.f5.com/articles/cve-2014-3566-removing-sslv3-from-big-ip

shaggy

Nimbostratus

Mar 04, 2015

Depending on your BIGIP software level, the DEFAULT cipher-suite may already have you covered: https://support.f5.com/kb/en-us/solutions/public/13000/100/sol13171

I believe the MD5 and EXPORT ciphers have been disabled in the DEFAULT cipher list since v10.2

Thorsten_90558
Nimbostratus
Mar 04, 2015
Right you are, they do. That's excellent.

Forum Discussion

iRule to mitigate TLS/SSL FREAK?

Recent Discussions

Wildcard SSL Certificate Deployment on F5 LTM

URL

Big-IP Next 20.2.0-2.375.1+0.0.43 iRule count problem

Problems connecting to vpn after upgrading to ubuntu 24.04

iRule resulting in too many redirects

Related Content

F5 ICAP over SSL/TLS (Secure ICAP) with F5 ASM/AWAF Antivirus Protection feature

TLS Fingerprinting to profile SSL/TLS clients without decryption

CitrixBleed Mitigation CVE-2023-4966

F5 Distributed Cloud L3-L7 DDoS Mitigation

CLIENT_HELLO SSL TLS version insert