For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

truongh_36312's avatar
truongh_36312
Icon for Nimbostratus rankNimbostratus
Dec 17, 2014

how to test for disable SSLv3 for vulnerability

We have a vip running on port 443 (clientssl) in bigp IP version 10.2.3. we turn off SSlv3 due to vulnerability. we change ciphers to DEFAULT:!SSLv3 in this SSLclient profile (not global clientssl profile). my question is how do we test SSLv3 is disable? after doing the research, I run this command in my F5 backend: openssl s_client -connect -ssl3

 

and got the message: getaddrinfo: Temporary failure in name resolution connect:errno=110

 

do you have otherway to test it or how to run this command correctly? Thanks for your help

 

4 Replies

  • kash_49328's avatar
    kash_49328
    Icon for Nimbostratus rankNimbostratus
    Dec 17, 2014

    Do the TCPdump and check it in the wireshark. I believe if you are not allowing sslv3 then Big ip should not allow the V3 hellos. Fyi 10.xx may be allowing SSLv2 also. I had 11.2.1 and it was allowing SSLv2 and v3. tcpdump -nni 0.0:nnn -s0 '(host xxxxxxx ) and port 443 or xxxx ' -w /var/tmp/xxxxxxx .pcap

     

  • shaggy's avatar
    shaggy
    Icon for Nimbostratus rankNimbostratus
    Dec 18, 2014

    curl is also an option. the -3 flag forces an SSLv3 handshake

    curl -kvv3 https://www.xyj.gov.au