The Internet Engineering
Task Force (IETF) has finished work on a fix to a vulnerability in
the Secure Sockets Layer protocol security researchers uncovered last
August.
The vulnerability
partially invalidates the SSL lock and allows attackers to compromise sites that use SSL for security—including banking
sites and back-office systems that use Web services-based protocols. The issue
was uncovered by Steve Dispensa and Marsh Ray, who work for two-factor
authentication provider PhoneFactor.
“The bug allows a
man-in-the-middle to insert some malicious data at the beginning of a
vulnerable SSL/TLS connection, but does not allow him to directly read the data sent by
the legitimate parties,” explained Ray. “This capability is referred to as a 'blind
plaintext injection attack.' Initially, it was hoped that this limited
capability would offer some mitigation. Unfortunately, it seems that HTTPS is
particularly strongly affected because of its design, and an effective attack
on the Twitter HTTPS API was demonstrated
shortly after the vulnerability was publicly disclosed.”
A copy of the
IETF draft can be found
here. After incorporating feedback from the TLS community, the proposed fix was
approved by the IESG on Jan. 7, 2010. The IESG is responsible for the
technical management of IETF activities and the Internet standards process. The
decision means customers can now begin to deliver patches that implement IETF's
change.
“Because of the large
number and variety of systems affected, substantial interoperability testing [for
the SSL
extension] will be conducted
by many vendors before they feel comfortable releasing a patch,” Ray said.
“Some interoperability testing has already been done with preliminary versions
of the patch, but another round of testing is occurring now that the details of
the fix have been finalized by the IETF.
“Some of the open-source TLS implementations (OpenSSL, GnuTLS)
have fixes in their publicly visible repositories, but have not released a
formal patch as of right now,” he added. “Most of the larger vendors (open
source and otherwise) have been given several months' head start on
implementing the fix, so they should not be starting from zero at this point.”
The company has developed a page to track the deployment
of patches for the issue. PhoneFactor’s
paper on the vulnerability can be viewed here
(PDF).
IT Security & Network Security News & Reviews News & Reviews 
