|
Title: Security Advisory for SSL/TLS Flaw Released by Microsoft Post by: don on September 28, 2011, 05:08:33 PM Article in MCP Mag by Chris Paoli:
Quote In response to a new threat of attack caused by a flaw in the Secure Socket Layer (SSL) 3.0 and Transport Layer Security (TLS) 1.0, Microsoft has issued Security Advisory 2588513 (http://blogs.technet.com/b/srd/archive/2011/09/26/is-ssl-broken-more-about-security-advisory-2588513.aspx), which contains a description and workarounds. The flaw, discovered and demonstrated by two security researchers last week, allows for a potential attacker to pull off a man-in-the-middle exploit by gaining access to a user's machine through an active HTTPS session. For full article: http://mcpmag.com/articles/2011/09/27/security-advisory-for-ssl-tls.aspx Don Title: Re: Security Advisory for SSL/TLS Flaw Released by Microsoft Post by: alucian on September 29, 2011, 06:56:41 AM From the article:
"Microsoft did not provide a fix with Monday's security advisory. However, it did provide a handful of workarounds, which include switching on TLS 1.1 in Internet Explorer, enabling Microsoft's browser to prompt users before running Active Scripting and prioritizing the RC4 algorithm to secure communication, among others. " Isn't RC4 a weak algorithm?? Title: Re: Security Advisory for SSL/TLS Flaw Released by Microsoft Post by: l33t5h@rk on October 07, 2011, 10:29:25 PM Isn't RC4 a weak algorithm?? Here's a link to prioritizing ciphers in Win 2K8 http://www.carbonwind.net/blog/post/A-quick-one-Setting-the-preferred-TLS-Cipher-Suite-on-TMG-Forefront-Beta-3-adding-a-little-bit-of-ephemerality.aspx (http://www.carbonwind.net/blog/post/A-quick-one-Setting-the-preferred-TLS-Cipher-Suite-on-TMG-Forefront-Beta-3-adding-a-little-bit-of-ephemerality.aspx) I don't think they were pushing RC4 for strength as much as it being a stream cipher and not a block cipher that BEAST exposed the vuln in.
Powered by SMF 1.1.18 |
SMF © 2013, Simple Machines
Joomla Bridge by JoomlaHacks.com |