Re: Welcome to the ietf-apps-tls mailing list
John Gardiner Myers <[email protected]>
| Newsgroups | gmane.ietf.apps-tls |
|---|---|
| Message-ID | <[email protected]> |
On Tue, 6 May 1997, Dennis Glatting wrote:
> If two parties support non-TLS connections and TLS
> connections and the TLS keyword is nuked, then a non-TLS
> connection may be established.
An implementation which accepts both TLS and non-TLS connections is
vulnerable to this attack, regardless of the method used for selecting
TLS. It is not specific to STARTTLS.
For example, if TLS and non-TLS connections are done on separate ports,
a MIM attacker could cause the connection to the TLS port to fail with a
fake ICMP Port Unreachable ("connection refused") error. Then, a non-TLS
connection may be established.