[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20141014131541.090af81a@pc>
Date: Tue, 14 Oct 2014 13:15:41 +0200
From: Hanno Böck <hanno@...eck.de>
To: oss-security@...ts.openwall.com
Subject: Re: Truly scary SSL 3.0 vuln to be revealed soon:
Am Tue, 14 Oct 2014 10:41:40 +0000
schrieb Sona Sarmadi <sona.sarmadi@...a.com>:
> This is probably something under embargo which somehow has leaked
> out ...
>
> http://www.theregister.co.uk/2014/10/14/nasty_ssl_30_vulnerability_to_drop_tomorrow/
Whether it's scary or not I have an advice for you: Disable SSLv3.
It causes a lot of headache already. I once had to debug a rather
subtle issue in combination with SNI.
The problem: Browsers downgrade out of protocol to SSLv3 if they can't
connect via TLS. They do this in order to support broken server
implementations. However this downgrade can also be triggered by bad or
slow internet connections - and then you'll loose SNI. So sometimes
your visitors will get the wrong certificate presented.
I solved this for my servers by disabling SSLv3. It was a minor problem
when I did this but it is almost no problem today.
You will lock out IE6 users on Windows XP. However even people who use
Windows XP+IE and installed their updates have TLS 1.0 support.
I also encountered a small number of people who had manually disabled
TLS 1.0 in firefox for unknown reasons. However this was a few years
ago. Current Firefox versions make it harder to do this. I assume the
reason was that they thought "v3 sound newer than v1.0".
A number of people already recommend disabling SSLv3, e.g. the Qualys
configuration guide. Disable it now - no matter if the rumors about a
serious vuln are true, you'll be safe.
cu,
--
Hanno Böck
http://hboeck.de/
mail/jabber: hanno@...eck.de
GPG: BBB51E42
Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
