ET POLICY FREAK Weak Export Suite From Client (CVE-2015-0204)
-
Hi all I am getting a bunch of these alerts from Suricata.
ET POLICY FREAK Weak Export Suite From Client (CVE-2015-0204)
One of the defined rules for one of these class of alerts is
#alert tcp $HOME_NET any -> any [21,25,110,143,443,465,587,636,989:995,5061,5222] (msg:"ET POLICY FREAK Weak Export Suite From Client (CVE-2015-0204)"; flow:established,to_server; content:"|16 03|"; depth:2; byte_test:1,<,4,0,relative; content:"|01|"; distance:3; within:1; byte_jump:1,37,relative; byte_extract:2,0,SuiteLength,relative; content:"|00 03|"; within:SuiteLength; fast_pattern; threshold:type limit,track by_src,count 1,seconds 1200; reference:url,blog.cryptographyengineering.com/2015/03/attack-of-week-freak-or-factoring-nsa.html; reference:cve,2015-0204; reference:cve,2015-1637; classtype:bad-unknown; sid:2020634; rev:4;)
the site being connected too is rules.emergingthreats.net. Checking it on freak attack shows that it is safe
Which could mean thats its me that has the problem?
Or is it a False Positive.How can it be fixed or do I just outright disable all those rules of that nature. They are 15 of them.
Thanks.