Date: Tue, 14 Oct 2014 13:15:41 +0200 From: Hanno Böck <hanno@...eck.de> To: oss-security@...ts.openwall.com Subject: Re: Truly scary SSL 3.0 vuln to be revealed soon: Am Tue, 14 Oct 2014 10:41:40 +0000 schrieb Sona Sarmadi <sona.sarmadi@...a.com>: > This is probably something under embargo which somehow has leaked > out ... > > http://www.theregister.co.uk/2014/10/14/nasty_ssl_30_vulnerability_to_drop_tomorrow/ Whether it's scary or not I have an advice for you: Disable SSLv3. It causes a lot of headache already. I once had to debug a rather subtle issue in combination with SNI. The problem: Browsers downgrade out of protocol to SSLv3 if they can't connect via TLS. They do this in order to support broken server implementations. However this downgrade can also be triggered by bad or slow internet connections - and then you'll loose SNI. So sometimes your visitors will get the wrong certificate presented. I solved this for my servers by disabling SSLv3. It was a minor problem when I did this but it is almost no problem today. You will lock out IE6 users on Windows XP. However even people who use Windows XP+IE and installed their updates have TLS 1.0 support. I also encountered a small number of people who had manually disabled TLS 1.0 in firefox for unknown reasons. However this was a few years ago. Current Firefox versions make it harder to do this. I assume the reason was that they thought "v3 sound newer than v1.0". A number of people already recommend disabling SSLv3, e.g. the Qualys configuration guide. Disable it now - no matter if the rumors about a serious vuln are true, you'll be safe. cu, -- Hanno Böck http://hboeck.de/ mail/jabber: hanno@...eck.de GPG: BBB51E42 Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ