Heartbleed Bug on F5

Question

Get the latest updates on how F5 mitigates Heartbleed&nbsp;Hello,&nbsp;
We are using F5 for our LTM and we are on OS V 10.0.0, we offload our SSL on F5.&nbsp;
I was testing the vulnerability on a website "https://www.ssllabs.com/ssltest/analyze.html?d=mail.sharjah.ac.ae" and I found some issues, like below:&nbsp;
Protocol support rated 0, Key Exchange rated 40,Cipher Strength 60.&nbsp;
Is this result are real, do we have to do something to solve it. Please find the image attached for the detail result.&nbsp;
Thanks and Regards
&nbsp;
a.latheef
University of Sharjah &nbsp;

nitass · Answer

sol10737: SSL Renegotiation vulnerability - CVE-2009-3555 / VU120541&nbsp;
http://support.f5.com/kb/en-us/solutions/public/10000/700/sol10737.html&nbsp;
sol7815: Configuring the cipher strength for SSL profiles (9.x - 10.x)&nbsp;
http://support.f5.com/kb/en-us/solutions/public/7000/800/sol7815.html&nbsp;
Implementation of forward secrecy in LTM&nbsp;
https://devcentral.f5.com/questions/implementation-of-forward-secrecy-in-ltm&nbsp;
hope this helps.&nbsp;

kevin_stewart · Answer

And here:&nbsp;
https://f5.com/solutions/mitigation/mitigating-openssl-heartbleed&nbsp;

mike_maher · Answer

So your issues have nothing to do with Heartbleed, the Qualys testing site does test for Heartbleed, however it is also checking the overall SSL setup and looking for other vulnerabilities as well. Your problems appear to me more related to older vulnerabilities like the insecure renegotiation it is seeing. By going through the links that nitass provided you can probably solve most of your problems.

Forum Discussion

Heartbleed Bug on F5

3 Replies

Recent Discussions

F5 Rseries HA

Error when running bigip_command Playbook against LTM : Syntax Error: unexpected argument /bin/sh\n

Can iRule be used to perform exception of IPI category based on Geolocation

Can iRule mask the payload content on event logs of security

minimum tmos software version for connect CIS (openshift)

Related Content

OpenSSL HeartBleed, CVE-2014-0160

SSL Heartbleed iRule update

US Intelligence Leaks, SwaaS, and OpenAI bug bounty - April 8th - 14th - This Week in Security

SSL Heartbleed server side iRule

Wat is Heartbleed?