oss-security - Re: CVE-2009-3555 for TLS renegotiation MITM attacks

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / NEWS community lists Wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [thread-next>] [month] [year] [list]

Date: Thu, 05 Nov 2009 18:24:09 +0100
From: Florian Weimer <fw@...eb.enyo.de>
To: oss-security@...ts.openwall.com
Subject: Re: CVE-2009-3555 for TLS renegotiation MITM attacks

* Mark J. Cox:

> http://extendedsubset.com/?p=8
> http://www.ietf.org/mail-archive/web/tls/current/msg03948.html and so
> on
> https://bugzilla.redhat.com/show_bug.cgi?id=533125
>
> Marsh Ray of PhoneFactor has discovered a flaw in the TLS/SSL protocol
> related to the handling of the session renegotiations.

Shouldn't this be credited to Martin Rex from SAP?  He's the first one
who publicly comitted to this vulnerability.  (And I'm slightly
surprised by the rapid me-too-ing that's going on here.)

Anyway, is the CVE just for HTTP over TLS, or more?

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.