Finally IETF have come out with a fix for the issue, it’s natural it has taken some time as it’s a flaw in the actual protocol itself not in any specific implementation (which is usually the case).
The bug was fairly serious as demonstrated by the Twitter-jacking that took place exploiting the flaw. The bug basically allowed an attacker to conduct a man-in-the-middle attack and insert some malicious data at the beginning of a vulnerable SSL/TLS connection.
A fix that addresses a security vulnerability that could threaten SSL-protected Websites has been given the greenlight. The Internet Engineering Task Force (IETF) has finished work on a fix to a vulnerability in the Secure Sockets Layer protocol security researchers uncovered last August.
The vulnerability partially invalidates the SSL lock and allows attackers to compromise sites that use SSL for security—including banking sites and back-office systems that use Web services-based protocols. The issue was uncovered by Steve Dispensa and Marsh Ray, who work for two-factor authentication provider PhoneFactor.
“The bug allows a man-in-the-middle to insert some malicious data at the beginning of a vulnerable SSL/TLS connection, but does not allow him to directly read the data sent by the legitimate parties,” explained Ray. “This capability is referred to as a ‘blind plaintext injection attack.’ Initially, it was hoped that this limited capability would offer some mitigation. Unfortunately, it seems that HTTPS is particularly strongly affected because of its design, and an effective attack on the Twitter HTTPS API was demonstrated shortly after the vulnerability was publicly disclosed.”
Some of the open source providers of SSL implementations have fixed the bug in their software and released publicly available patches. These however are not officially merged with the main development trees as they were waiting for the official fix from the IETF.
It will take a while for all the major vendors to roll this into their software I guess, I’d hope to see everyone rolling out fixes by the end of January latest.
Who knows how many sites/apps are quietly being owned out there due to this bug.
A copy of the IETF draft can be found here. After incorporating feedback from the TLS community, the proposed fix was approved by the IESG on Jan. 7, 2010. The IESG is responsible for the technical management of IETF activities and the Internet standards process. The decision means customers can now begin to deliver patches that implement IETF’s change.
“Because of the large number and variety of systems affected, substantial interoperability testing [for the SSL extension] will be conducted by many vendors before they feel comfortable releasing a patch,” Ray said. “Some interoperability testing has already been done with preliminary versions of the patch, but another round of testing is occurring now that the details of the fix have been finalized by the IETF.
“Some of the open-source TLS implementations (OpenSSL, GnuTLS) have fixes in their publicly visible repositories, but have not released a formal patch as of right now,” he added. “Most of the larger vendors (open source and otherwise) have been given several months’ head start on implementing the fix, so they should not be starting from zero at this point.”
I’m glad to see something has been done about this issue and it has been treated seriously, imagine what would have happened if this was an issue with a Microsoft product?
They’d point fingers and create some FUD story claiming it wasn’t critical and only effected a small amount of systems under very specific circumstances.
- OpenVAS 7 Released – Open Source Vulnerability Scanner
- Google Leaves Android Users Vulnerable To WebView Exploit
- pwntools – CTF Framework & Exploit Development Library
- Microsoft Fixes SSL Spoofing Renegotiation Bug
- THC SSL DoS/DDoS Tool Released For Download
- SSL Renegotiation Bug Succesfully Used To Attack Twitter
Most Read in Exploits/Vulnerabilities:
- Learn to use Metasploit – Tutorials, Docs & Videos - 228,910 views
- AJAX: Is your application secure enough? - 119,312 views
- eEye Launches 0-Day Exploit Tracker - 85,158 views