Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    ET POLICY FREAK Weak Export Suite From Client (CVE-2015-0204)

    pfSense Packages
    1
    1
    752
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • P
      pfsenseboonie last edited by

      Hi all I am getting a bunch of these alerts from Suricata.

      ET POLICY FREAK Weak Export Suite From Client (CVE-2015-0204)

      One of the defined rules for one of these class of alerts is

      #alert tcp $HOME_NET any -> any [21,25,110,143,443,465,587,636,989:995,5061,5222] (msg:"ET POLICY FREAK Weak Export Suite From Client (CVE-2015-0204)"; flow:established,to_server; content:"|16 03|"; depth:2; byte_test:1,<,4,0,relative; content:"|01|"; distance:3; within:1; byte_jump:1,37,relative; byte_extract:2,0,SuiteLength,relative; content:"|00 03|"; within:SuiteLength; fast_pattern; threshold:type limit,track by_src,count 1,seconds 1200; reference:url,blog.cryptographyengineering.com/2015/03/attack-of-week-freak-or-factoring-nsa.html; reference:cve,2015-0204; reference:cve,2015-1637; classtype:bad-unknown; sid:2020634; rev:4;)

      the site being connected too is rules.emergingthreats.net.  Checking it on freak attack shows that it is safe
      Which could mean thats its me that has the problem?
      Or is it a False Positive.

      How can it be fixed or do I just outright disable all those rules of that nature.  They are 15 of them.

      Thanks.

      1 Reply Last reply Reply Quote 0
      • First post
        Last post