Forum Discussion
Hamish
Cirrocumulus
CirrocumulusSSL Vulnerability
Does anyone know if F5's with SSL Offload are vulnerable to the plain text insertion vulnerability that's been reported today?
Details are vague (As you'd expect) but IIUC it may be on...
HamishCirrocumulus
Cirrocumulus
Hi Aaron.
The IETF mailing list link is http://www.ietf.org/mail-archive/web/tls/current/msg03942.html 'el reg' has the article I first saw at http://www.theregister.co.uk/2009/11/05/serious_ssl_bug/ and then the more in-depth info is at http://extendedsubset.com/?p=8
I'm still reading the paper he wrote to discover exactly how bad the vulnerability is. But it's not actually limited to just client auth certificate negotiation apparently.
H
