[openssl-users] BEAST and SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
jb-openssl at wisemo.com
Wed Jul 22 13:35:06 UTC 2015
On 22/07/2015 14:12, jonetsu wrote:
> Our Nessus version 6.4.1 is detecting a BEAST vulnerability against OpenSSL 1.0.1e. The source code defines SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS as 0x00000800L and several tests are made for this value in the code. The CHANGES mentions though that this had some side effects, the option now being part of SSL_OP_ALL. It would look like, from the scan, that the fragments are not enabled by default, could it be ?
Yep, for some silly reason,
SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS was/is included in
the default value SSL_OP_ALL. This is in the same
header as SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS.
The proper solution, as just about everybody knows
by now would have been to insert 1-byte fragments
(known as the 1/n-1 solution) which some other
SSL/TLS implementations do.
Jakob Bohm, CIO, Partner, WiseMo A/S. http://www.wisemo.com
Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10
This public discussion message is non-binding and may contain errors.
WiseMo - Remote Service Management for PCs, Phones and Embedded
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the openssl-users