For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Hamish's avatar
Hamish
Icon for Cirrocumulus rankCirrocumulus
Nov 05, 2009

SSL Vulnerability

Does anyone know if F5's with SSL Offload are vulnerable to the plain text insertion vulnerability that's been reported today?     Details are vague (As you'd expect) but IIUC it may be on...
config
design
Lupo_38935's avatar
Lupo_38935
Icon for Nimbostratus rankNimbostratus
Nov 06, 2009
Hamish: As outlined in the "Renegotiating TLS" paper, insertion is indeed possible even without the use of client certificat authentication. The real impact then depends on the application.

 

To be on the safe side I opted to prevent mid-stream renegotiation altogether where possible.

 

See also my iRule post: http://devcentral.f5.com/Default.aspx?tabid=53&forumid=5&postid=86456&view=topic