Corrine Posted October 15, 2014 Share Posted October 15, 2014 A security vulnerability in SSL 3.0 has been uncovered by Bodo Möller and two other Google employees that attackers can exploit to calculate the plaintext of secure connections. SSL 3.0 is an old protocol and most Internet servers use the newer TLS 1.0, TLS 1.1 or TLS 1.2 protocols instead. Client and server usually agree to use the latest protocol version during connections during protocol handshake but since TLS is backwards compatible with SSL 3.0, it can happen that SSL 3.0 is being used instead. During the first handshake attempt the highest supported protocol version is offered but if this handshake fails, earlier protocol versions are offered instead. An attacker controlling the network between the client and server could interfere with the handshake attempt so that SSL 3.0 is used instead of TLS. Instructions are available at the source on how to protect your web browser. See SSL 3.0 vulnerability discovered. Find out how to protect yourself. Note, however, that the link to test the Protocols includes the caveat, "This test reliably detects only the highest supported protocol." Thus, it reliably detects TLS 1.2, but will not reliably detect if SSL3 is disabled. https://www.ssllabs.com/ssltest/viewMyClient.html 2 Quote Link to comment Share on other sites More sharing options...
Corrine Posted October 16, 2014 Author Share Posted October 16, 2014 https://www.ssllabs.com/ssltest/viewMyClient.html has been updated and now correctly shows "No" for SSL 3. 2 Quote Link to comment Share on other sites More sharing options...
.thumb.jpg.7c3caaf218a75d76e16db7a5bddfb463.jpg)
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.