Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Reading about the SSL renegotiation problem CVE-2009-3555 one knows that servers supporting old type of renegotiation are vulnerable to data injection. We also have tools to test them (openssl s_client and Qualsys SSL labs).

But what's the situation with clients? After checking the https://ssltls.de site using few browsers, it would seem that the only two browsers that have fixed this problem are Firefox (since 3.5.9 and 3.6.2) and Opera (since 11.00 or 10.50?).

Browsers that are still vulnerable according to the site are:

  • Chrome 9.0.597.16
  • Chrome 12.0.742.124 (!)
  • Chrome 13.0.782.56 beta
  • Chrome 14.0.825.0 dev
  • Internet Explorer 9 (!)
  • Konqueror 4.6.3

Is this test reliable? Or is the situation really this grim?

Edit: Is there a way to use openssl s_server to test client's vulnerability?

share|improve this question
    
Safari 5.1 on Mac OS Lion is still vulnerable. –  Wei Hu Aug 5 '11 at 18:28
    
@Wei Hu: According to the site ssltls.de, or did Apple still not applied a quick hack (disable renegotiation)? –  Hubert Kario Aug 6 '11 at 13:34
    
According the cite you linked to. –  Wei Hu Aug 8 '11 at 8:15
add comment

1 Answer 1

up vote 4 down vote accepted

All current versions of the major browsers (IE/FF/Chrome) are actually patched with the fix for secure renegotiation.

The ssltls.de site has some problems it seems, as I went to it using different browsers, different network connections, and I got inconsistent results. Wireshark shows the browsers sending the extension and server replying to it, so it seems the test can be improved to better detect the extension.

share|improve this answer
1  
Now that is interesting! –  Rory Alsop Jul 21 '11 at 17:23
    
For one, the use of different port numbers was blocked by the proxy on one of the connections I used. That immediately flaged all browsers as vulnerable. –  Nasko Jul 21 '11 at 22:01
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.