Thorsten_90558
Mar 04, 2015Nimbostratus
iRule to mitigate TLS/SSL FREAK?
In before the crowd: Please respond if you have an iRule to mitigate the FREAK attack on TLS/SSL via RSA-EXPORT. (CVE-2015-0204 on OpenSSL, see also https://www.smacktls.com/freak and http://blog.cryptographyengineering.com/2015/03/attack-of-week-freak-or-factoring-nsa.html )
Also, any word on whether the admin web server in TMOS is affected?
Depending on the version of TMOS you're running you may not need to do anything, but I would disable it in the SSL profile rather than an iRule, these items should prevent it (I think): !MD5:!EXP:!EXPORT40
This article talks about disabling ciphers on the management plane: https://devcentral.f5.com/articles/cve-2014-3566-removing-sslv3-from-big-ip