TLS RC4 Cipher Deprecation

Strike ID:
A15-56001
CVSS:
5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
False Positive:
f
Variants:
108
Year:
2015

Description

This strike simulates a TLS handshake using an RC4 cipher suite. As of RFC7465, the RC4 cipher suite has been deprecated due to a number of exploits capable of decrypting portions of RC4 encrypted messages. This strike may operate in two different manners. In the first scenario, the client will send a mix of supported cipher suites, including RC4 cipher suites. The server will select an RC4 suite. This case may seen in traffic between a client and a man-in-the-middle attacker downgrading the session, or in normal traffic with an out-of-date client and server. In the second scenario, the client will send a list of supported cipher suites containing only RC4 cipher suites. This traffic may be seen between a server and a man-in-the-middle attacker downgrading the session, or in normal traffic with an out-of-date client. It is worth noting that the handshake cannot be positively identified as malicious, however any traffic using RC4 is vulnerable to possible decryption. Use of RC4 ciphers should be discontinued.

CVE

References