http://isc.sans.org/diary.html?storyid=7543&rss
OpenSSL has released a new version (OpenSSL 0.9.8l). It should be noted that this update does not "fix" the vulnerability in the protocol. It appears that they have made the choice to simply remove TLS/SSL negotiation from their package by default. I would urge anyone who is running a SSL enabled site that uses OpenSSL to thoroughly test their application as well as any software clients that are in used with their application. There has been some discussion on the effects of simply removing renegotiation from these packages or disabling them by default (as OpenSSL has done). There will no doubt be instances where clients/servers will cease to function properly when renegotiation is disabled or removed. The nice thing about what OpenSSL has done is if you do run into issues, it appears to be an easy fix (set a flag and -hup!). So as always make sure to test vigorously before you deploy!
------------------------------
Also, Leviathan Security has released a technical overview of the vulnerabilities and possible mitigation, along with a simple detection tool to see if your server excepts client renegotiations.
http://www.leviathansecurity.com/pdf/Renegotiating_TLS.pdf
http://www.leviathansecurity.com/pdf/ssltlstest.zip
No comments:
Post a Comment