oss-sec mailing list archives
Re: CVE-2009-3555 for TLS renegotiation MITM attacks
From: Florian Weimer <fw () deneb enyo de>
Date: Thu, 05 Nov 2009 18:24:09 +0100
* Mark J. Cox:
http://extendedsubset.com/?p=8 http://www.ietf.org/mail-archive/web/tls/current/msg03948.html and so on https://bugzilla.redhat.com/show_bug.cgi?id=533125 Marsh Ray of PhoneFactor has discovered a flaw in the TLS/SSL protocol related to the handling of the session renegotiations.
Shouldn't this be credited to Martin Rex from SAP? He's the first one who publicly comitted to this vulnerability. (And I'm slightly surprised by the rapid me-too-ing that's going on here.) Anyway, is the CVE just for HTTP over TLS, or more?
Current thread:
- CVE-2009-3555 for TLS renegotiation MITM attacks Mark J Cox (Nov 05)
- Re: CVE-2009-3555 for TLS renegotiation MITM attacks Florian Weimer (Nov 05)
- Re: CVE-2009-3555 for TLS renegotiation MITM attacks Eygene Ryabinkin (Nov 06)
- Re: [TLS] [oss-security] CVE-2009-3555 for TLS renegotiation MITM attacks Marsh Ray (Nov 07)
- Re: [TLS] [oss-security] CVE-2009-3555 for TLS renegotiation MITM attacks Peter Gutmann (Nov 08)
- Re: CVE-2009-3555 for TLS renegotiation MITM attacks ArkanoiD (Nov 08)
- Re: [TLS] [oss-security] CVE-2009-3555 for TLS renegotiation MITM attacks Marsh Ray (Nov 08)
- Re: [TLS] [oss-security] CVE-2009-3555 for TLS renegotiation MITM attacks Marsh Ray (Nov 07)