Subscribe to the RSS feed in case you are interested in updates
In order to allow me to update in a more convenient manner, the latest updates will be added to the G-SEC blog only. Once the final revision of this blog post will be achieved I will update this blog with the latest one.
Updated 21:00 GMT+1 / 12.2009 - added a whitepaper trying to explain the vulnerability and it's implications to a broader audience
After some in-house tests, we can confirm that the vulnerability presented at http://www.extendedsubset.com/ indeed real and should pose a significant threat to most. The vulnerability has been discovered by "Marsh Ray".
We are currently looking into possible mitigations and will update this blog post regularly with more information regarding said vulnerability - if available.
Mikestoolbox.net - Test client implementation for TLS renegotiation extension
Patches
OpenSSL 0.9.81( Attention: OpenSSL removed the TLS/SSL renegotiation feature from this package - you need to test application before/after updating to this version ) (via ISC)
GnuTLS patch (implements a new TLS extension proposed in the IETF Draft) (via SID)
Apache patch (patches renogtiation prefix attacks at the application layer, still need openssl fixes for other attacks)
Impacts :
Currently known to exist
In general an attacker positioned in the middle of a connection may inject arbritary content into the beginning of an authenticated strea, it will be interesting to see what potential impact this vulnerability has within each of the applications / protocols supporting it. IMAPS, FTPSSL, POP3 etc
For web servers - Attackers (if in the middle) can inject data into a segment that is authenticated to the web server, the web server will merge those requests and process them. (GET requests are trivially exploitable, POST are not known to be)
Mitigations :
Monitor renegotiation requests
To mitigate possible attacks against web applications - use an IPS/IDS/Application firewall to catch recurrent HTTP request that are enclosed within each other
Posts
