The idea of this attack is that it is taking place int he SSL handshake, hence the client is still not aware of the MITM and since the attack manages to downgrade the key of the encryption it will manage to make your client believe it is talking to the real server. So if someone manages to MITM your client with the client and server both using open ssl with the vulnerable versions its game over.

This blog post has a nice explanation and insite into the bug: https://www.imperialviolet.org/2014/06/05/earlyccs.html

The idea of this attack is that it is taking place in the SSL handshake, hence the client is still not aware of the MITM and since the attack manages to downgrade the key of the encryption it will manage to make your client believe it is talking to the real server. So if someone manages to MITM your client with the client and server both using open ssl with the vulnerable versions its game over.

This blog post has a nice explanation and insite into the bug: https://www.imperialviolet.org/2014/06/05/earlyccs.html