Re: [jetty-user] "CVE-2009-3555 Prevent SSL renegotiate for SSL vulnerability" not fixed?

Brett,

I'm not part of the Jetty team, nor am I an expert on this topic. I just suggest, for the sake of speed of response, that you let the team know exactly which version of Java your client's system is running on, since the SSL implementation is provided by Java, not by Jetty itself. Also the OS info. might be needed.

Regards,

Chris



On Thursday, September 9, 2010 at 1:24:02 AM, Brett Wooldridge wrote:
> We are using Jetty 6.1.22, which supposedly contains a fix for
> CVE-2009-3555.  However, one of our customer's security scanners is flagging
> our server has having this vulnerability.

> After doing some research, I found this site regarding how to verify that
> SSL Renegotiation is disabled.

> http://blog.ivanristic.com/2009/12/testing-for-ssl-renegotiation.html

> Basically, you use openssl to connect, send a 'HEAD' request, initiate
> renegotiation, and you *should* receive an error, as show below:

> $ openssl s_client -connect server:443

> [snip... a lot of openssl output]

> ---

> HEAD / HTTP/1.0<press enter>
> R<press enter>
> RENEGOTIATING
> <press enter>
> 28874:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake
> failure:s3_pkt.c:530:

> However, Jetty does NOT generate a renegotiation failure.  In fact it
> continues with renegotiation and returns the content of the head request.

> Jetty 6.1.22's SslSelectChannelConnector is supposed to default to no
> renegotiation (allowRenegotiate=false), but even when I set it explicitly in
> the .xml configuration to false, it still seems to honor the renegotiation.

> Can anyone shed light on this, this is a serious problem if CVE-2009-3555 is
> not really fixed.

> -Brett


---------------------------------------------------------------------
To unsubscribe from this list, please visit:

    http://xircles.codehaus.org/manage_email