iRule to mitigate TLS/SSL FREAK?

Question

In before the crowd: Please respond if you have an iRule to mitigate the FREAK attack on TLS/SSL via RSA-EXPORT. (CVE-2015-0204 on OpenSSL, see also https://www.smacktls.com/freak and http://blog.cryptographyengineering.com/2015/03/attack-of-week-freak-or-factoring-nsa.html )&nbsp;
Also, any word on whether the admin web server in TMOS is affected?&nbsp;

lee_payne_53457 · Accepted Answer

Depending on the version of TMOS you're running you may not need to do anything, but I would disable it in the SSL profile rather than an iRule, these items should prevent it (I think): !MD5:!EXP:!EXPORT40&nbsp;
This article talks about disabling ciphers on the management plane: https://devcentral.f5.com/articles/cve-2014-3566-removing-sslv3-from-big-ip&nbsp;

thorsten_90558 · Answer

Thanks! You are right, as long as the BigIP functions as an LTM in full proxy and doesn't just pass the traffic through, the SSL Profile is the right place to configure this. I wasn't thinking :)

shaggy_121467 · Answer

Depending on your BIGIP software level, the DEFAULT cipher-suite may already have you covered: https://support.f5.com/kb/en-us/solutions/public/13000/100/sol13171&nbsp;
I believe the MD5 and EXPORT ciphers have been disabled in the DEFAULT cipher list since v10.2&nbsp;

shaggy · Answer

Depending on your BIGIP software level, the DEFAULT cipher-suite may already have you covered: https://support.f5.com/kb/en-us/solutions/public/13000/100/sol13171&nbsp;
I believe the MD5 and EXPORT ciphers have been disabled in the DEFAULT cipher list since v10.2&nbsp;

thorsten_90558 · Answer

Right you are, they do. That's excellent.

thorsten_90558 · Answer

Right you are, they do. That's excellent.

Forum Discussion

iRule to mitigate TLS/SSL FREAK?

11 Replies

Recent Discussions

Error while running ansible

ASM instance creation

[ASM] - what is "Browser Challange file" ?

[ASM] - HTML5 Cross-Domain Request Enforcement - CLI command

Reverse Proxy Not Behaving

Related Content

CitrixBleed Mitigation CVE-2023-4966

F5 ICAP over SSL/TLS (Secure ICAP) with F5 ASM/AWAF Antivirus Protection feature

F5 Distributed Cloud L3-L7 DDoS Mitigation

Mitigating OWASP API Security risks using BIG-IP

TLS Fingerprinting to profile SSL/TLS clients without decryption