Tenable Responds to CVE-2015-0204: FREAK Vulnerability
It seems that in recent history, the SSL library continues to give security teams plenty of opportunities to interface with systems/application administrators and vendors to upgrade SSL in their environments. The latest vulnerability to impact SSL is CVE-2015-0204, known in the media as "FREAK," short for Factoring RSA EXPORT Keys. FREAK can facilitate a man-in-the-middle attack and force a browser to export a weak 512-bit key, which can be factored in just a few hours. On January 8, 2015, Openssl.org posted the vulnerability with a severity of Low in its security advisory. However, this vulnerability has gained attention most recently when a Washington Post article cited a former U.S. government policy that forbade the export of strong encryption. While this issue impacts all versions of OpenSSL, other software titles that do not properly handle the use of weak algorithms could also be affected. A fix for FREAK in OpenSSL is available as of OpenSSL v1.0.2. Other vendors are also making SSL updates available.
SecurityCenter dashboard
While OpenSSL is prevalent and the impact to operations teams can be significant, there is no reason to freak out; Tenable already has you covered! A SecurityCenter Continuous View™ SSL Discovery dashboard is available for tracking SSL usage in your environment. We have updated the components to specifically call out CVE-2015-0204 to make it even easier to track its impact and remediation.
Nessus plugins
When you scan your environment for FREAK utilizing Nessus®, be sure to look at these plugins:
- 26928: SSL Weak Cipher Suites Supported
- 81606: SSL/TLS RSA-EXPORT <= 512-bit Cipher Suites Supported (FREAK) (newly released)
As always, you can also search for CVE-2015-0204 on our Nessus Plugins page to find the latest Nessus plugins.
This blog will be updated as events warrant.
Related Articles
How A CNAPP Can Take You From Cloud Security Novice To Native In 10 Steps
May 23, 2024Context is critical in cloud security. In a recent RSA presentation, Tenable's Shai Morag offered ten tips for end-to-end cloud infrastructure security.
Consolidate and Unify to Accelerate Your Security Efforts
October 13, 2022CISOs want to shrink their cybersecurity tool stack and see improved interoperability among products so that they can draw actionable insights from uniform and normalized data. Here we explain why this is key for understanding your environment’s security posture and empowering you to make better decisions about mitigating risk.
Narrow Focus on CVEs Leaves Organizations Vulnerable to Attacks
October 21, 2021CWEs and other vulnerabilities necessitate a single dashboard for complete cyber risk assessment A growing number of cybersecurity professionals have evolved their legacy vulnerability manageme...
Cybersecurity Snapshot: Critical Infrastructure Orgs Found Vulnerable to Basic Hacks, While New MITRE Tool Uses ML to Predict Attack Chains
September 20, 2024Report finds that many critical infrastructure networks can be breached using simple attacks. Plus, a new MITRE Engenuity tool uses machine learning to infer attack sequences. Meanwhile, CISA will lead a project to standardize civilian agencies’ cyber operations. And get the latest on XSS vulnerabilities, CIS Benchmarks and a China-backed botnet’s takedown!
An Analyst’s Guide to Cloud-Native Vulnerability Management: Where to Start and How to Scale
September 19, 2024Cloud-native workloads introduce a unique set of challenges that complicate traditional approaches to vulnerability management. Learn how to address these challenges and scale cloud-native VM in your org.
Mastering Containerization: Key Strategies and Best Practices
September 17, 2024As organizations modernize their infrastructure, containers offer unparalleled flexibility and scalability but they also introduce unique security challenges. In this blog we explain container security challenges, identify top threats and share how the newly released Tenable Enclave Security can keep your containers secure.
- Dashboards
- Nessus
- OpenSSL
- Plugins
- SecurityCenter