Reading about the SSL renegotiation problem CVE-2009-3555 one knows that servers supporting old type of renegotiation are vulnerable to data injection. We also have tools to test them (
openssl s_client and Qualsys SSL labs).
But what's the situation with clients? After checking the https://ssltls.de site using few browsers, it would seem that the only two browsers that have fixed this problem are Firefox (since 3.5.9 and 3.6.2) and Opera (since 11.00 or 10.50?).
Browsers that are still vulnerable according to the site are:
- Chrome 9.0.597.16
- Chrome 12.0.742.124 (!)
- Chrome 13.0.782.56 beta
- Chrome 14.0.825.0 dev
- Internet Explorer 9 (!)
- Konqueror 4.6.3
Is this test reliable? Or is the situation really this grim?
Is there a way to use
openssl s_server to test client's vulnerability?