TLS Protocol Session Renegotiation Security Vulnerability Prevention

Assuming you're referring to CVE-2009-3555, you'd need to upgrade to at least 10.2.3 or 11.x.

sol10737: SSL Renegotiation vulnerability - CVE-2009-3555 / VU120541

SSL Profiles Part 6: SSL Renegotiation

One thing I'll add is that enabling secure renegotiation on a server SSL profile will break connections if the server isn't patched accordingly. We encountered this for many different applications after upgrading to v11. In an ideal world, all servers would be patched for this renegotiation vulnerability, especially since it's been around for so long, but...

Something to keep in mind when upgrading.

Our Image is : BIG-IP 10.2.4 Build 817.0 Hotfix HF7

Hi,

As I shared that our Image is : BIG-IP 10.2.4 Build 817.0 Hotfix HF7 and as per the document shared by Kevin, ours should not be vulnerable as : TLS Protocol Session Renegotiation Security Vulnerability.

Seondly Cory, I tried by modifying : 'Secure Renegotiation' to either 'require' or 'require strict'( into SSL Client Profile). But it didn't helped, after scanning the same again, we got the same Vulnerability again.

Kindly suggest.

Thanks and Regards Parveez

The setting is to enforce secure renegotiation with the server, so you'd need to change that on the server SSL profile.

We are not using any Server SSL Profile for now. So, incase I create a Server SSL Profile and do that settings, do the end server also should have SSL certificates ?

Will it work ?

Thanks and Regards Parveez

If you are going to apply a server SSL profile, then yes your server will need to be configured with a certificate and to accept SSL connections.

So it sounds like if your scanner is still finding the TLS renegotiation vulnerability after changing your client SSL profile to either 'require' or 'require strict', then it's a false positive.

Hi Cory,

Yes it seems like a false-positive case as its trying that.

SO, can we ignore this for now, because we dont use server SSL certificates.

Thanks and Regards Parveez