|Check Point Reference:||CPAI-2015-0571|
|Date Published:||17 May 2015|
|Last Updated:||3 Dec 2017|
|Protection Provided by:||
|Who is Vulnerable?||SSL Servers|
|Vulnerability Description||RC4 is a widely supported stream cipher, often preferred by TLS servers and other servers using encrypted sessions. It has long been known to have a variety of cryptographic weaknesses. Recent cryptanalysis results, one of which is the "Bar Mitzvah attack", exploit biases in the RC4 keystream to recover repeatedly encrypted plaintexts. As a result, RC4 can no longer be seen as providing a sufficient level of security for encrypted sessions.|
This protection will detect and block SSL and TLS connections using weak RC4 cipher suites.
In order for the protection to be activated, update your Security Gateway product to the latest IPS update. For information on how to update IPS, go to SBP-2006-05, click on Protection tab and select the version of your choice.
This protection's log will contain the following information:
Attack Name: SSL Enforcement Violation.
Attack Information: Weak SSL RC4 Cipher Suites