ET POLICY FREAK Weak Export Suite From Client (CVE-2015-0204)



  • Hi all I am getting a bunch of these alerts from Suricata.

    ET POLICY FREAK Weak Export Suite From Client (CVE-2015-0204)

    One of the defined rules for one of these class of alerts is

    #alert tcp $HOME_NET any -> any [21,25,110,143,443,465,587,636,989:995,5061,5222] (msg:"ET POLICY FREAK Weak Export Suite From Client (CVE-2015-0204)"; flow:established,to_server; content:"|16 03|"; depth:2; byte_test:1,<,4,0,relative; content:"|01|"; distance:3; within:1; byte_jump:1,37,relative; byte_extract:2,0,SuiteLength,relative; content:"|00 03|"; within:SuiteLength; fast_pattern; threshold:type limit,track by_src,count 1,seconds 1200; reference:url,blog.cryptographyengineering.com/2015/03/attack-of-week-freak-or-factoring-nsa.html; reference:cve,2015-0204; reference:cve,2015-1637; classtype:bad-unknown; sid:2020634; rev:4;)

    the site being connected too is rules.emergingthreats.net.  Checking it on freak attack shows that it is safe
    Which could mean thats its me that has the problem?
    Or is it a False Positive.

    How can it be fixed or do I just outright disable all those rules of that nature.  They are 15 of them.

    Thanks.


Log in to reply