Re: Truly scary SSL 3.0 vuln to be revealed soon:

[Hanno Böck <hanno () hboeck de>]

Am Tue, 14 Oct 2014 10:41:40 +0000
schrieb Sona Sarmadi <sona.sarmadi () enea com>:

> This is probably something under embargo which somehow has leaked
> out ...
>
> http://www.theregister.co.uk/2014/10/14/nasty_ssl_30_vulnerability_to_drop_tomorrow/

Whether it's scary or not I have an advice for you: Disable SSLv3.

It causes a lot of headache already. I once had to debug a rather
subtle issue in combination with SNI.
The problem: Browsers downgrade out of protocol to SSLv3 if they can't
connect via TLS. They do this in order to support broken server
implementations. However this downgrade can also be triggered by bad or
slow internet connections - and then you'll loose SNI. So sometimes
your visitors will get the wrong certificate presented.
I solved this for my servers by disabling SSLv3. It was a minor problem
when I did this but it is almost no problem today.

You will lock out IE6 users on Windows XP. However even people who use
Windows XP+IE and installed their updates have TLS 1.0 support.
I also encountered a small number of people who had manually disabled
TLS 1.0 in firefox for unknown reasons. However this was a few years
ago. Current Firefox versions make it harder to do this. I assume the
reason was that they thought "v3 sound newer than v1.0".

A number of people already recommend disabling SSLv3, e.g. the Qualys
configuration guide. Disable it now - no matter if the rumors about a
serious vuln are true, you'll be safe.

cu,
-- 
Hanno Böck
http://hboeck.de/

mail/jabber: hanno () hboeck de
GPG: BBB51E42

Attachment: signature.asc
Description: