iRule to mitigate TLS/SSL FREAK?

In before the crowd: Please respond if you have an iRule to mitigate the FREAK attack on TLS/SSL via RSA-EXPORT. (CVE-2015-0204 on OpenSSL, see also https://www.smacktls.com/freak and http://blog.cryptographyengineering.com/2015/03/attack-of-week-freak-or-factoring-nsa.html )

Also, any word on whether the admin web server in TMOS is affected?

application delivery

devops

Lee_Payne_53457
Mar 04, 2015
Depending on the version of TMOS you're running you may not need to do anything, but I would disable it in the SSL profile rather than an iRule, these items should prevent it (I think): !MD5:!EXP:!EXPORT40

This article talks about disabling ciphers on the management plane: https://devcentral.f5.com/articles/cve-2014-3566-removing-sslv3-from-big-ip

Lee_Payne_53457
Cirrostratus
Mar 04, 2015
Depending on the version of TMOS you're running you may not need to do anything, but I would disable it in the SSL profile rather than an iRule, these items should prevent it (I think): !MD5:!EXP:!EXPORT40

This article talks about disabling ciphers on the management plane: https://devcentral.f5.com/articles/cve-2014-3566-removing-sslv3-from-big-ip
- Thorsten_90558
  Nimbostratus
  Mar 04, 2015
  Thanks! You are right, as long as the BigIP functions as an LTM in full proxy and doesn't just pass the traffic through, the SSL Profile is the right place to configure this. I wasn't thinking :)
shaggy_121467
Cumulonimbus
Mar 04, 2015
Depending on your BIGIP software level, the DEFAULT cipher-suite may already have you covered: https://support.f5.com/kb/en-us/solutions/public/13000/100/sol13171

I believe the MD5 and EXPORT ciphers have been disabled in the DEFAULT cipher list since v10.2
- Thorsten_90558
  Nimbostratus
  Mar 04, 2015
  Right you are, they do. That's excellent.
shaggy
Nimbostratus
Mar 04, 2015
Depending on your BIGIP software level, the DEFAULT cipher-suite may already have you covered: https://support.f5.com/kb/en-us/solutions/public/13000/100/sol13171

I believe the MD5 and EXPORT ciphers have been disabled in the DEFAULT cipher list since v10.2
- Thorsten_90558
  Nimbostratus
  Mar 04, 2015
  Right you are, they do. That's excellent.
shaggy_121467
Cumulonimbus
Mar 04, 2015
Check out https://devcentral.f5.com/articles/getting-freak-y-with-big-ip
- Thorsten_90558
  Nimbostratus
  Mar 05, 2015
  Thank you for the link, that's a great writeup!
shaggy
Nimbostratus
Mar 04, 2015
Check out https://devcentral.f5.com/articles/getting-freak-y-with-big-ip
- Thorsten_90558
  Nimbostratus
  Mar 05, 2015
  Thank you for the link, that's a great writeup!
cjbarr1234
Nimbostratus
Mar 04, 2015
I went through this a while ago.. Give this a shot:

https://devcentral.f5.com/articles/cve-2014-3566-removing-sslv3-from-big-ip

Forum Discussion

iRule to mitigate TLS/SSL FREAK?

Recent Discussions

Cookie not RFC-compliant - Cookie has no value

F5 Next - how to reference irule procedures

Question regarding the F5 vulnerabilities page API

About Customized AWAF Rules

Blocking client that uses existing cookie

Related Content

TLS Fingerprinting to profile SSL/TLS clients without decryption

JA4 Part 2: Detecting and Mitigating Based on Dynamic JA4 Reputation

F5 ICAP over SSL/TLS (Secure ICAP) with F5 ASM/AWAF Antivirus Protection feature

CLIENT_HELLO SSL TLS version insert

CitrixBleed Mitigation CVE-2023-4966