Learn F5 Technologies, Get Answers & Share Community Solutions Join DevCentral

Filter by:
  • Solution
  • Technology
Answers

Removing Poodle TLS padding vulnerability returns RC4 warning

Hi,

We are running F5 LTM version 11.2. Recently we disabled the RC4 weak CIPHER to remove the Minimal warning from our PCI scan.

But due to the recent arrival of Poodle TLS vulnarability we had to introduce RC4-SHA:!SSLv3 which brought back the Minimal warning for having RC4 in the acceptable CIPHER.

How can we over come this?

This was done via F5 support suggestion. (https://support.f5.com/kb/en-us/solutions/public/15000/800/sol15882.html)

Previous CIPHER: NATIVE:DHE+HIGH:!SSLv3:!NULL:!RC4:!MD5:!EXP:!LOW:!EXPORT:!DES:@SPEED New CIPHER to remove Poodle TLS: RC4-SHA:!SSLv3:!NULL:!MD5:!EXP:!LOW:!EXPORT:!DES:!DHE:!EDH:@SPEED:@STRENGTH

0
Rate this Question

Answers to this Question

placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER

Hi

the F5 solution 15882 states "To mitigate this vulnerability, you can create a custom cipher string for the SSL profile that uses RC4 or AES-GCM ciphers"

AES-GCM is not supported in pre 11.5.0 releases.

I think here you should upgrade (11.2.1 HF13 is the closest to your release, with TLS poodle fixed)

Alex

0
placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER

Alex is correct, the solution for POODLE TLS and some other attacks is to enable only RC4. but on the other side RC4 is considered unsafe itself and will probably to publicly announced to be disabled at some time in future.

so the best fix for POODLE TLS remains the hotfix version.

0