Re: [jetty-user] "CVE-2009-3555 Prevent SSL renegotiate for SSL vulnerability" not fixed?

I am running on Java 1.6u20.  Platforms are MacOS 10.6.4, Windows (all
versions >= XP literally), and Linux (CentOS 5.2).  However, the Java
version should not be relavent because Jetty provided a fix to CVE-2009-3555
of it's own (ahead of Sun's fix) as seen in the release notes of Jetty
6.1.22.

Regards,
Brett


On Thu, Sep 9, 2010 at 3:18 PM, Chris Haynes <[email protected]>wrote:

> Brett,
>
> I'm not part of the Jetty team, nor am I an expert on this topic. I just
> suggest, for the sake of speed of response, that you let the team know
> exactly which version of Java your client's system is running on, since the
> SSL implementation is provided by Java, not by Jetty itself. Also the OS
> info. might be needed.
>
> Regards,
>
> Chris
>
>
>
> On Thursday, September 9, 2010 at 1:24:02 AM, Brett Wooldridge wrote:
> > We are using Jetty 6.1.22, which supposedly contains a fix for
> > CVE-2009-3555.  However, one of our customer's security scanners is
> flagging
> > our server has having this vulnerability.
>
> > After doing some research, I found this site regarding how to verify that
> > SSL Renegotiation is disabled.
>
> > http://blog.ivanristic.com/2009/12/testing-for-ssl-renegotiation.html
>
> > Basically, you use openssl to connect, send a 'HEAD' request, initiate
> > renegotiation, and you *should* receive an error, as show below:
>
> > $ openssl s_client -connect server:443
>
> > [snip... a lot of openssl output]
>
> > ---
>
> > HEAD / HTTP/1.0<press enter>
> > R<press enter>
> > RENEGOTIATING
> > <press enter>
> > 28874:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake
> > failure:s3_pkt.c:530:
>
> > However, Jetty does NOT generate a renegotiation failure.  In fact it
> > continues with renegotiation and returns the content of the head request.
>
> > Jetty 6.1.22's SslSelectChannelConnector is supposed to default to no
> > renegotiation (allowRenegotiate=false), but even when I set it explicitly
> in
> > the .xml configuration to false, it still seems to honor the
> renegotiation.
>
> > Can anyone shed light on this, this is a serious problem if CVE-2009-3555
> is
> > not really fixed.
>
> > -Brett
>
>
> ---------------------------------------------------------------------
> To unsubscribe from this list, please visit:
>
>    http://xircles.codehaus.org/manage_email
>
>
>