Date: Fri, 8 Jul 2011 15:23:45 +0200 From: Tomas Hoger <thoger@...hat.com> To: OSS Security <oss-security@...ts.openwall.com> Subject: SSL renegotiation DoS CVE-2011-1473 Hi! FYI, as this has a nessus test, and likely to be seen and reported by users. CVE-2011-1473 is used seemingly for the SSL protocol issue. Most TLS/SSL implementations handle session renegotiation by default, client may trigger high CPU use by renegotiating repeatedly and taking advantage of the fact that there's more work to do on the server side than on the client side. Similar problem affects initial handshake too, renegotiation allows achieving the same over single / few connections. This should affect most server apps using openssl and nss, but not recent httpd/mod_ssl. Original blog post is not accessible, but TLS WG list post has all the relevant info. http://orchilles.com/2011/03/ssl-renegotiation-dos.html http://www.ietf.org/mail-archive/web/tls/current/msg07553.html http://www.nessus.org/plugins/index.php?view=single&id=53491 -- Tomas Hoger / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.