Forum Discussion

Suzyw720_345395's avatar
Suzyw720_345395
Icon for Nimbostratus rankNimbostratus
Apr 29, 2018

Remove TLS_RSA for PFS?

Given these ciphers supported on an 11.6.2HF1 LTM, if the server is using RSA certificates, to prevent the ROBOT vulnerability, do we just need to remove the (7) TLS_RSA ciphers noted at the end of t...
LTM
security
Simon_Blakely's avatar
Simon_Blakely
Icon for Employee rankEmployee
Apr 29, 2018

If you are running 11.6.2 HF1, you have already mitigated ROBOT even if you continue to use RSA key Exchange.

 

K21905460: BIG-IP SSL vulnerability (ROBOT) CVE-2017-6168

 

Please be aware of the note in K21905460

 

Note: Fixed BIG-IP versions do not disable RSA key exchange, they eliminate the existing code flaw in our implementation of RSA key exchange. Due to influences outside the control of the BIG-IP system, some SSL rating sites and scanners may falsely report that fixed versions are vulnerable to CVE-2017-6168. In these instances you may want to contact the scanner vendor to report the false positive result.