Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 0 down vote favorite
1

I have -MultiViews set and SSLInsecureNegotation off ( in ifmodule of mod_ssl.c) in Apache.

But still vulnerability report says I am vulnerable to client side renegotiation and "This server is vulnerable to MITM attacks because it supports insecure renegotiation".

Any pointers ?

The same configuration works on our TEST environments. THe only difference is the build release versions.

The systems where it is vulnerable has 31 around release build and in our TEST environment we have 53 release build version)

All on apache 2.2.3 (Oracle provided)

Thanks !

share|improve this question
Just to add I am able to do "R" in Openssl but not in TEST env. – Novice User Jan 12 at 13:04
2  
you should spend more time editing your posts, it is very difficult to understand what you are asking. I think this is about the SSL renegotiation DoS... of course clients are going to negotiate the ssl connection... that ss how it SSL works! **RE**negotation however is a very power DoS attack... Which is totally lost by this horribly written post. – Rook Jan 13 at 7:21
@Rook : My apologies... Unfortunately i didnt had the technical details much about the issue as its a bit complex corporate setup. From a generic point of view i was trying to understand it. Thanks for your suggestion. I shall consider this thread as closed now. – Novice User Jan 15 at 18:53

Know someone who can answer? Share a link to this question via email, Google+, Twitter, or Facebook.

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.