The Ethical Hacker Network - Security Advisory for SSL/TLS Flaw Released by Microsoft

Latest Additions

Who's Online

EH-Net > Ethical Hacking Discussions and Related Certifications > Malware (Moderator: don) > Security Advisory for SSL/TLS Flaw Released by Microsoft

Pages: [1] Go Down

« previous next »

	Author	Topic: Security Advisory for SSL/TLS Flaw Released by Microsoft (Read 2929 times)
0 Members and 1 Guest are viewing this topic.

don

Editor-In-Chief
Administrator
Hero Member

Offline

Posts: 4169

Editor-In-Chief

Security Advisory for SSL/TLS Flaw Released by Microsoft

« on: September 28, 2011, 05:08:33 PM »

Article in MCP Mag by Chris Paoli:

Quote

In response to a new threat of attack caused by a flaw in the Secure Socket Layer (SSL) 3.0 and Transport Layer Security (TLS) 1.0, Microsoft has issued Security Advisory 2588513, which contains a description and workarounds.

The flaw, discovered and demonstrated by two security researchers last week, allows for a potential attacker to pull off a man-in-the-middle exploit by gaining access to a user's machine through an active HTTPS session.

For full article:
http://mcpmag.com/articles/2011/09/27/security-advisory-for-ssl-tls.aspx

Don


	Logged

CISSP, MCSE, CSTA, Security+ SME

alucian

Full Member

Offline

Posts: 225

Re: Security Advisory for SSL/TLS Flaw Released by Microsoft

« Reply #1 on: September 29, 2011, 06:56:41 AM »

From the article:
"Microsoft did not provide a fix with Monday's security advisory. However, it did provide a handful of workarounds, which include switching on TLS 1.1 in Internet Explorer, enabling Microsoft's browser to prompt users before running Active Scripting and prioritizing the RC4 algorithm to secure communication, among others. "

Isn't RC4 a weak algorithm??