<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 22/07/2015 14:12, jonetsu wrote:<br>
</div>
<blockquote cite="mid:d15e52af26bc94e341f8a13fa1bc2cd3@teksavvy.com"
type="cite">
<pre wrap="">Hello,
Our Nessus version 6.4.1 is detecting a BEAST vulnerability against OpenSSL 1.0.1e. The source code defines SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS as 0x00000800L and several tests are made for this value in the code. The CHANGES mentions though that this had some side effects, the option now being part of SSL_OP_ALL. It would look like, from the scan, that the fragments are not enabled by default, could it be ?
</pre>
</blockquote>
<tt>Yep, for some silly reason, <br>
SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS was/is included in <br>
the default value SSL_OP_ALL.</tt><tt> This is in the same <br>
header as SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS.<br>
</tt><tt><br>
</tt><tt>The proper solution, as just about everybody knows <br>
by now would have been to insert 1-byte fragments <br>
(known as the 1/n-1 solution) which some other <br>
SSL/TLS implementations do.</tt><tt><br>
</tt><br>
<br>
<pre class="moz-signature" cols="72">Enjoy
Jakob
--
Jakob Bohm, CIO, Partner, WiseMo A/S. <a class="moz-txt-link-freetext" href="http://www.wisemo.com">http://www.wisemo.com</a>
Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10
This public discussion message is non-binding and may contain errors.
WiseMo - Remote Service Management for PCs, Phones and Embedded </pre>
</body>
</html>