IETF Completes Fix for SSL Security Vulnerability
A fix that addresses a security vulnerability that could threaten SSL-protected Websites has been given the greenlight.The Internet Engineering Task Force (IETF) has finished work on a fix to a vulnerability in the Secure Sockets Layer protocol security researchers uncovered last August. The vulnerability partially invalidates the SSL lock and allows attackers to compromise sites that use SSL for security-including banking sites and back-office systems that use Web services-based protocols. The issue was uncovered by Steve Dispensa and Marsh Ray, who work for two-factor authentication provider PhoneFactor.
"The bug allows a man-in-the-middle to insert some malicious data at the beginning of a vulnerable SSL/TLS connection, but does not allow him to directly read the data sent by the legitimate parties," explained Ray. "This capability is referred to as a 'blind plaintext injection attack.' Initially, it was hoped that this limited capability would offer some mitigation. Unfortunately, it seems that HTTPS is particularly strongly affected because of its design, and an effective attack on the Twitter HTTPS API was demonstrated shortly after the vulnerability was publicly disclosed."