Vulnerability scans show that the SMG MTA will accept Diffie-Hellman (DH) key exchange with a 1024 bit key when negotiating TLS.
While SMG is not vulnerable to the Logjam vulnerability there is some concern that some nation state level actors may be able to decrypt an SMTP session negotiated using 1024 bit DH key exchange by a brute force attack on the key exchange.
Currently there is no means of removing just the 1024 bit DH key exchange leaving SMG to do 2048 bit or greater DH key exchange.
For environments which cannot allow SMG to use 1024 bit DH key exchange, DH key exchange by the SMG MTA can be disabled via the following process:
mta-control all set-tls-ciphers 'ALL:!ADH:+HIGH:-MEDIUM:-LOW:-SSLv2:-EXP:-eNULL:-aNULL:!DH'
service mta restart
Note: This significantly reduces the number of available ciphersuites and may cause an inability to negotiate secure TLS connections with some older SMTP TLS implementations. Broadcom support can provide no recommendation in this situation other than to return SMG to its default TLS cipher configuration as follows:
mta-control all set-tls-ciphers default