[ruby-core:48118] [ruby-trunk - Bug #5353] TLS v1.0 and less - Attack on CBC mode

Issue #5353 has been updated by elninorian (menuju sukses sukses).



hey buddy, this is a very interesting article
really good things here, just thanks
http://www.howtogetaflatstomachforgirls.com/
http://www.howtogetaflatstomachforgirls.com/lose-weight/lose-weight-teenage-girls/
http://www.howtogetaflatstomachforgirls.com/uncategorized/reviews-flat-belly-diet-book-work/
http://www.howtogetaflatstomachforgirls.com/diet/diet-rich-cellulose/
http://www.howtogetaflatstomachforgirls.com/belly-fat/flat-belly-menopause/
http://www.howtogetaflatstomachforgirls.com/flat-belly/flat-belly-menu-plan-vegetarians/
http://www.howtogetaflatstomachforgirls.com/flat-stomach-for-girls/how-to-get-a-flat-stomach-for-girls-in-2-weeks/
http://www.howtogetaflatstomachforgirls.com/have-a-flat-stomach-for-girls/how-to-have-a-flat-stomach-for-girls-a/
http://www.howtogetaflatstomachforgirls.com/weight-loss-secrets/the-secret-to-losing-weight/
http://www.howtogetaflatstomachforgirls.com/exercise-to-slim-legs/exercise-to-slim-legs/
http://www.howtogetaflatstomachforgirls.com/weight-loss-secrets/lose-6-pounds-in-a-week/
http://www.howtogetaflatstomachforgirls.com/diet/ketogenic-diet-risks/
http://www.howtogetaflatstomachforgirls.com/lose-pounds/lose-6-pounds-in-two-weeks/
http://www.howtogetaflatstomachforgirls.com/belly-fat/belly-fat-under-belly-button/
http://www.howtogetaflatstomachforgirls.com/flat-stomach-for-girls/how-to-get-a-flat-stomach-for-girls-fast/
http://www.howtogetaflatstomachforgirls.com/a-flat-stomach/flat-stomach-in-a-month/
http://www.howtogetaflatstomachforgirls.com/belly-fat/flatten-belly-fast/
http://www.howtogetaflatstomachforgirls.com/abs/how-to-get-abs-for-girls-women/
http://www.howtogetaflatstomachforgirls.com/flat-stomach-fast-for-girls/how-to-get-a-flat-stomach-for-girls-a/
http://www.howtogetaflatstomachforgirls.com/flat-belly/flat-belly-solution/
http://www.howtogetaflatstomachforgirls.com/exercises-work/exercises-work-flat-stomach/
http://www.howtogetaflatstomachforgirls.com/a-flat-stomach/foods-flat-stomach/
http://www.howtogetaflatstomachforgirls.com/flat-stomach-diet-does-work/flat-stomach-diet-work/
http://www.howtogetaflatstomachforgirls.com/cardio-training-tips-workout/cardio-training-tips-workout-flat-stomach/
http://www.howtogetaflatstomachforgirls.com/bonus-buy-flat-stomach/bonus-buy-flat-stomach-diet-does-work/
http://www.howtogetaflatstomachforgirls.com/flat-stomach-ebook/flat-stomach-ebook-download/
http://www.howtogetaflatstomachforgirls.com/flat-stomach-program/flat-stomach-programme-exercise-training-workout-gym-2012/
http://www.howtogetaflatstomachforgirls.com/abs/how-to-have-defined-abs/
http://www.howtogetaflatstomachforgirls.com/weight-loss-secrets/lose-weight-while-walking/
http://www.howtogetaflatstomachforgirls.com/stomach-for-girls-in-a-week/how-to-get-a-flat-stomach-for-girls-in-a-week-for-teenagers/
http://www.howtogetaflatstomachforgirls.com/secrets-to-lose-weight-fast/secrets-to-lose-weight-fast/
http://www.howtogetaflatstomachforgirls.com/exercises-for-flat-stomach/how-to-get-a-flat-stomach-for-girls-exercises/
http://www.howtogetaflatstomachforgirls.com/to-get-a-flat-stomach-at-home-for-girls/how-to-get-a-flat-stomach-at-home-for-girls-fast-for-girls-at-home/
http://www.howtogetaflatstomachforgirls.com/tips-for-slimming-stomach/tips-for-slimming-stomach-weigh-your-belly/
http://www.howtogetaflatstomachforgirls.com/flat-stomach-for-girls/flat-stomach-for-girls/
http://www.howtogetaflatstomachforgirls.com/a-flat-stomach/a-flat-stomach-the-ideal-diet-and-exercise-system-beautiful-belly/
http://www.howtogetaflatstomachforgirls.com/belly-fat/flat-belly-menu-plan/
http://www.howtogetaflatstomachforgirls.com/flat-belly/menu-plan-flat-belly-diet/
http://www.howtogetaflatstomachforgirls.com/weight-loss-secrets/lose-3-kg-in-3-days-how-to-lose-3-kg-in-3-days/
http://www.howtogetaflatstomachforgirls.com/diet/moerman-diet/
http://www.howtogetaflatstomachforgirls.com/weight-loss-secrets/lose-4-kg-how-to-lose-4-kg/
http://www.howtogetaflatstomachforgirls.com/belly-fat/how-to-lose-belly-fat-swimming/
http://www.howtogetaflatstomachforgirls.com/belly-fat/fast-flatten-belly-fast/
http://www.howtogetaflatstomachforgirls.com/how-to-lose-3-kg-in-a-month/how-to-lose-3-kg-in-a-month/
http://www.howtogetaflatstomachforgirls.com/flat-stomach-for-girls/girls-with-flat-stomach/
http://www.howtogetaflatstomachforgirls.com/flat-stomach-for-girls/how-long-does-it-take-to-get-a-flat-stomach-for-girls/
http://www.howtogetaflatstomachforgirls.com/how-do-i-lose-weight-in-a-week/how-do-i-lose-weight-in-a-week/

http://www.fatburningfoodsformen1.com/belly-fat-exercises-for-men.htm
http://www.fatburningfoodsformen1.com/abs-exercises-for-men.htm
http://www.fatburningfoodsformen1.com/green-tea-burn-belly-fat.htm
http://www.fatburningfoodsformen1.com/belly-fat-exercises-for-men.htm
http://www.fatburningfoodsformen1.com/the-man-diet-free-download.htm

----------------------------------------
Bug #5353: TLS v1.0 and less - Attack on CBC mode
https://bugs.ruby-lang.org/issues/5353#change-31080

Author: MartinBosslet (Martin Bosslet)
Status: Assigned
Priority: High
Assignee: nahi (Hiroshi Nakamura)
Category: ext
Target version: 2.0.0
ruby -v: -


A well-known vulnerability of TLS v1.0 and earlier has recently gained some attention:

http://www.theregister.co.uk/2011/09/19/beast_exploits_paypal_ssl/

Although this has been known for a long time (http://www.openssl.org/~bodo/tls-cbc.txt),
and a fix for this has been provided, in reality most applications seem to be working with

SSL_OP_ALL

which is a flag that enables some bug workarounds that were considered harmless. 

We, too, use this in ossl_sslctx_s_alloc(VALUE klass) in ossl_ssl.c. Unfortunately, 
this flag also includes

SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS

which disables the fix for the "CBC vulnerability". Here is what a comment says 
about the flag (OpenSSL 1.0.0d)

    /* Disable SSL 3.0/TLS 1.0 CBC vulnerability workaround that was added
     * in OpenSSL 0.9.6d.  Usually (depending on the application protocol)
     * the workaround is not needed.  Unfortunately some broken SSL/TLS
     * implementations cannot handle it at all, which is why we include
     * it in SSL_OP_ALL. */

If I understand http://www.openssl.org/~bodo/tls-cbc.txt correctly, the most
notable implementation that does not play well with these empty fragments
was (is?) IE - I don't know how this has evolved over time, I would have to 
research further.

An easy fix for the situation would be to discard SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS,
but this would risk affecting existing installations.

What do you propose? Should we solve this before the 1.9.3 release? 

(PS: The actual attack and fix are outlined in 

http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.61.5887&rep=rep1&type=pdf

The attack to be presented by Thai Duong and Juliano Rizzo at 

http://ekoparty.org/cronograma.php (caution: currently the site is victim to the "reddit effect")

is very likely to be based on what was already known and should therefore hopefully
require no further fixes.) 

 


-- 
http://bugs.ruby-lang.org/