New Logjam Attack

[Hithead]

Hi,

a new leak was found in diffie hellmann...

http://arstechnica.com/security/2015/05/https-crippling-attack-threatens-tens-of-thousands-of-web-an...

https://threatpost.com/new-logjam-attack-on-diffie-hellman-threatens-security-of-browsers-vpns/11291...

(german) http://www.heise.de/newsticker/meldung/Logjam-Attacke-Verschluesselung-von-zehntausenden-Servern-gef...

Is PaloAlto also affected? And is PaloAlto working on a threat signature?

[kattaullah · Accepted solution]

We have signature for CVE-2015-4000. The threat ID number is 37756 (Export Diffie-Hellman Cipher Suite Found). This was released with the content update 502. 

The attack is only effective when DHE_EXPORT cipher suite is effective. 

PAN-OS doesn't use DHE_EXPORT. So PAN-OS is not vulnerable to this CVE.

[BATMANi]

Palo Alto is Aware of this , Engineering is researching on this and once there is an update it will be provided publicly .

[ulti]

how about a threat signature update to alert on logjam attempts... <queue jeopardy music>

[kattaullah · Accepted solution]

We have signature for CVE-2015-4000. The threat ID number is 37756 (Export Diffie-Hellman Cipher Suite Found). This was released with the content update 502. 

The attack is only effective when DHE_EXPORT cipher suite is effective. 

PAN-OS doesn't use DHE_EXPORT. So PAN-OS is not vulnerable to this CVE.

[KiCheon.Lee]

Do you know what method for key exchange else DH to access mgmt web ?