oss-security - SSL renegotiation DoS CVE-2011-1473

Openwall GNU/*/Linux 3.0 - a small security-enhanced Linux distro for servers

[<prev] [next>] [day] [month] [year] [list]

Date: Fri, 8 Jul 2011 15:23:45 +0200
From: Tomas Hoger <thoger@...hat.com>
To: OSS Security <oss-security@...ts.openwall.com>
Subject: SSL renegotiation DoS CVE-2011-1473

Hi!

FYI, as this has a nessus test, and likely to be seen and reported by
users.

CVE-2011-1473 is used seemingly for the SSL protocol issue.  Most
TLS/SSL implementations handle session renegotiation by default, client
may trigger high CPU use by renegotiating repeatedly and taking
advantage of the fact that there's more work to do on the server side
than on the client side.  Similar problem affects initial handshake
too, renegotiation allows achieving the same over single / few
connections.

This should affect most server apps using openssl and nss, but not
recent httpd/mod_ssl.

Original blog post is not accessible, but TLS WG list post has all the
relevant info.

http://orchilles.com/2011/03/ssl-renegotiation-dos.html
http://www.ietf.org/mail-archive/web/tls/current/msg07553.html
http://www.nessus.org/plugins/index.php?view=single&id=53491

-- 
Tomas Hoger / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.