IETF Completes Vulnerability Fix For SSL Renegotiation Bug


You should remember the SSL Renegotiation bug from last year that was used to successfully attack twitter.

Finally IETF have come out with a fix for the issue, it’s natural it has taken some time as it’s a flaw in the actual protocol itself not in any specific implementation (which is usually the case).

The bug was fairly serious as demonstrated by the Twitter-jacking that took place exploiting the flaw. The bug basically allowed an attacker to conduct a man-in-the-middle attack and insert some malicious data at the beginning of a vulnerable SSL/TLS connection.

A fix that addresses a security vulnerability that could threaten SSL-protected Websites has been given the greenlight. The Internet Engineering Task Force (IETF) has finished work on a fix to a vulnerability in the Secure Sockets Layer protocol security researchers uncovered last August.

The vulnerability partially invalidates the SSL lock and allows attackers to compromise sites that use SSL for security—including banking sites and back-office systems that use Web services-based protocols. The issue was uncovered by Steve Dispensa and Marsh Ray, who work for two-factor authentication provider PhoneFactor.

“The bug allows a man-in-the-middle to insert some malicious data at the beginning of a vulnerable SSL/TLS connection, but does not allow him to directly read the data sent by the legitimate parties,” explained Ray. “This capability is referred to as a ‘blind plaintext injection attack.’ Initially, it was hoped that this limited capability would offer some mitigation. Unfortunately, it seems that HTTPS is particularly strongly affected because of its design, and an effective attack on the Twitter HTTPS API was demonstrated shortly after the vulnerability was publicly disclosed.”

Some of the open source providers of SSL implementations have fixed the bug in their software and released publicly available patches. These however are not officially merged with the main development trees as they were waiting for the official fix from the IETF.

It will take a while for all the major vendors to roll this into their software I guess, I’d hope to see everyone rolling out fixes by the end of January latest.

Who knows how many sites/apps are quietly being owned out there due to this bug.

A copy of the IETF draft can be found here. After incorporating feedback from the TLS community, the proposed fix was approved by the IESG on Jan. 7, 2010. The IESG is responsible for the technical management of IETF activities and the Internet standards process. The decision means customers can now begin to deliver patches that implement IETF’s change.

“Because of the large number and variety of systems affected, substantial interoperability testing [for the SSL extension] will be conducted by many vendors before they feel comfortable releasing a patch,” Ray said. “Some interoperability testing has already been done with preliminary versions of the patch, but another round of testing is occurring now that the details of the fix have been finalized by the IETF.

“Some of the open-source TLS implementations (OpenSSL, GnuTLS) have fixes in their publicly visible repositories, but have not released a formal patch as of right now,” he added. “Most of the larger vendors (open source and otherwise) have been given several months’ head start on implementing the fix, so they should not be starting from zero at this point.”

I’m glad to see something has been done about this issue and it has been treated seriously, imagine what would have happened if this was an issue with a Microsoft product?

They’d point fingers and create some FUD story claiming it wasn’t critical and only effected a small amount of systems under very specific circumstances.

Source: eWeek

Posted in: Exploits/Vulnerabilities, Secure Coding

, , , , , ,


Latest Posts:


Sooty - SOC Analyst All-In-One CLI Tool Sooty – SOC Analyst All-In-One CLI Tool
Sooty is a tool developed with the task of aiding a SOC analyst to automate parts of their workflow and speed up their process.
UBoat - Proof Of Concept PoC HTTP Botnet Project UBoat – Proof Of Concept PoC HTTP Botnet Project
UBoat is a PoC HTTP Botnet designed to replicate a full weaponised commercial botnet like the famous large scale infectors Festi, Grum, Zeus and SpyEye.
LambdaGuard - AWS Lambda Serverless Security Scanner LambdaGuard – AWS Lambda Serverless Security Scanner
LambdaGuard is a tool which allows you to visualise and audit the security of your serverless assets, an open-source AWS Lambda Serverless Security Scanner.
exe2powershell - Convert EXE to BAT Files exe2powershell – Convert EXE to BAT Files
exe2powershell is used to convert EXE to BAT files, the previously well known tool for this was exe2bat, this is a version for modern Windows.
HiddenWall - Create Hidden Kernel Modules HiddenWall – Create Hidden Kernel Modules
HiddenWall is a Linux kernel module generator used to create hidden kernel modules to protect your server from attackers.
Anteater - CI/CD Security Gate Check Framework Anteater – CI/CD Security Gate Check Framework
Anteater is a CI/CD Security Gate Check Framework to prevent the unwanted merging of filenames, binaries, deprecated functions, staging variables and more.


One Response to IETF Completes Vulnerability Fix For SSL Renegotiation Bug

  1. foobee January 19, 2010 at 5:26 pm #

    the piece was good until you got into the ms bashing