Full Disclosure mailing list archives
TLS Renegotiation Vulnerability: Proof of Concept Code (Python)
From: RedTeam Pentesting GmbH <release () redteam-pentesting de>
Date: Mon, 21 Dec 2009 14:04:32 +0100
Information about a vulnerability in the TLS protocol was published in the beginning of November 2009. Attackers can take advantage of that vulnerability to inject arbitrary prefixes into a network connection protected by TLS. This can result in severe vulnerabilities, depending on the application layer protocol used over TLS. RedTeam Pentesting used the Python module "TLS Lite" to develop proof of concept code that exploits this vulnerability. It is published at http://www.redteam-pentesting.de/publications/tls-renegotiation to raise awareness for the vulnerability and its potential impact. Furthermore, it shall give interested persons the opportunity to analyse applications employing TLS for further vulnerabilities. -- RedTeam Pentesting GmbH Tel.: +49 241 963-1300 Dennewartstr. 25-27 Fax : +49 241 963-1304 52068 Aachen http://www.redteam-pentesting.de/ Germany Registergericht: Aachen HRB 14004 Geschäftsführer: Patrick Hof, Jens Liebchen, Claus R. F. Overbeck
Attachment:
_bin
Description:
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- TLS Renegotiation Vulnerability: Proof of Concept Code (Python) RedTeam Pentesting GmbH (Dec 21)