For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

orange_193813's avatar
orange_193813
Icon for Nimbostratus rankNimbostratus
Mar 26, 2015

TLS POODLE Vulnerability

Hi, We have configured DEFAULT:!SSLv3:!TLSv1 in the cipher settings in for each SSL certificate but when we do a scan we still see that the message in the scan on https://www.ssllabs.com as "This server is vulnerable to the POODLE attack against TLS servers. Patching required. Grade set to F". Could someone please advise if there is any more configuration setting that can be done to elimintae this attack other than upgrading the software to latest 11.5.xx? Below is the F5 version details F5 Version: BIG-IP 11.2.1 Build 807.0 Hotfix HF1

 

Thanks in advance for the reply.

 

application delivery
LTM

2 Replies

  • Hannes_Rapp's avatar
    Hannes_Rapp
    Icon for Nimbostratus rankNimbostratus
    Mar 26, 2015

    Where did you get this cipher config? To me it does not seem correct. Until BigIP 11.4.1, to mitigate TLS/Poodle (TLS Padding vulnerability) you should enforce the use of RC4-SHA cipher. This could cut off some users that don't support the cipher. For your cipher config, use 

    !SSLv3:RC4-SHA
    instead.