Skip to main content

Is SecureAuth IdP Impacted by the "FREAK" Vulnerability (CVE-2015-1637)?


Microsoft® has released Security Advisory 3046015 which describes the exposure of Microsoft products to the F actoring R SA E xport K eys (FREAK) vulnerability. SecureAuth IdP Appliances leverage the Windows Server® platform and SecureAuth has released this technical note to communicate with customers any exposure our products might have to the FREAK vulnerability.

Impact on SecureAuth IdP

At this time, SecureAuth IdP customers are not impacted by the FREAK vulnerability. Microsoft does not enable the export ciphers below on Windows Server 2008 R2, 2012, and 2012 R2 by default. With these ciphers inactive the exploit cannot be used by a bad actor.





For customers using SecureAuth IdP Appliances with theWindows Server 2003operating system, SecureAuth's default OS hardening process prevents the vulnerability from being exploited.

SecureAuth strongly recommends upgrading appliances to the latest version of the product and Microsoft Windows Server version. The SecureAuth IdP upgrade is free to customers with a current support contract. Contact to speak with a support representative about the upgrade process.


What is the scope of this document?

The purpose of this document is to notify customers that SecureAuth is aware of a security vulnerability affecting the Schannel mechanism of Windows Server. The vulnerability could allow a Man-in-the-middle attack which forces the downgrading of the cipher used in an SSL/TLS connection on a Windows server to a weaker cipher.

How could an attacker exploit the vulnerability?

In a Man-in-the-middle attack, the attacker could downgrade an encrypted SSL/TLS session and force client systems to use the weaker RSA export cipher. The attacker could then intercept and decrypt this traffic.

What is the FREAK vulnerability?

The flaw is due to a former U.S. government policy which restricted export of strong encryption and required that weaker "export-grade" products be shipped to customers in other countries. These restrictions were eventually lifted in the latter half of the 1990s, however the weaker encryption is still present in some software. Researchers recently discovered they could force browsers to use the weaker encryption and exploit its weakness. A bad actor can launch a Man-in-the-middle attack and decrypt the protected information between the browser and server using brute force decryption methods. With advances in processor power and inexpensive clusters (like Amazon Web Service) the "export grade" encryption can be broken in roughly 7 hours, according to researchers.