[ad]<\/p>\n
You should remember the SSL Renegotiation bug<\/a> from last year that was used to successfully attack twitter<\/a>.<\/p>\n Finally IETF have come out with a fix for the issue, it’s natural it has taken some time as it’s a flaw in the actual protocol itself not in any specific implementation (which is usually the case).<\/p>\n The bug was fairly serious as demonstrated by the Twitter-jacking that took place exploiting the flaw. The bug basically allowed an attacker to conduct a man-in-the-middle<\/a> attack and insert some malicious data at the beginning of a vulnerable SSL\/TLS connection.<\/p>\n A fix that addresses a security vulnerability that could threaten SSL-protected Websites has been given the greenlight. The Internet Engineering Task Force (IETF) has finished work on a fix to a vulnerability in the Secure Sockets Layer protocol security researchers uncovered last August.<\/p>\n The vulnerability partially invalidates the SSL lock and allows attackers to compromise sites that use SSL for security\u2014including banking sites and back-office systems that use Web services-based protocols. The issue was uncovered by Steve Dispensa and Marsh Ray, who work for two-factor authentication provider PhoneFactor.<\/p>\n \u201cThe bug allows a man-in-the-middle to insert some malicious data at the beginning of a vulnerable SSL\/TLS connection, but does not allow him to directly read the data sent by the legitimate parties,\u201d explained Ray. \u201cThis capability is referred to as a ‘blind plaintext injection attack.’ Initially, it was hoped that this limited capability would offer some mitigation. Unfortunately, it seems that HTTPS is particularly strongly affected because of its design, and an effective attack on the Twitter HTTPS API was demonstrated shortly after the vulnerability was publicly disclosed.\u201d<\/p><\/blockquote>\n Some of the open source providers of SSL implementations have fixed the bug in their software and released publicly available patches. These however are not officially merged with the main development trees as they were waiting for the official fix from the IETF.<\/p>\n It will take a while for all the major vendors to roll this into their software I guess, I’d hope to see everyone rolling out fixes by the end of January latest.<\/p>\n Who knows how many sites\/apps are quietly being owned out there due to this bug.<\/p>\n A copy of the IETF draft can be found here<\/a>. After incorporating feedback from the TLS community, the proposed fix was approved by the IESG on Jan. 7, 2010. The IESG is responsible for the technical management of IETF activities and the Internet standards process. The decision means customers can now begin to deliver patches that implement IETF’s change.<\/p>\n \u201cBecause of the large number and variety of systems affected, substantial interoperability testing [for the SSL extension] will be conducted by many vendors before they feel comfortable releasing a patch,\u201d Ray said. \u201cSome interoperability testing has already been done with preliminary versions of the patch, but another round of testing is occurring now that the details of the fix have been finalized by the IETF.<\/p>\n \u201cSome of the open-source TLS implementations (OpenSSL, GnuTLS) have fixes in their publicly visible repositories, but have not released a formal patch as of right now,\u201d he added. \u201cMost of the larger vendors (open source and otherwise) have been given several months’ head start on implementing the fix, so they should not be starting from zero at this point.\u201d<\/p><\/blockquote>\n I’m glad to see something has been done about this issue and it has been treated seriously, imagine what would have happened if this was an issue with a Microsoft<\/a> product?<\/p>\n They’d point fingers and create some FUD story claiming it wasn’t critical and only effected a small amount of systems under very specific circumstances.<\/p>\n <\/p>\n