On 22/07/2015 14:12, jonetsu wrote:
Hello,
Our Nessus version 6.4.1 is detecting a BEAST vulnerability against OpenSSL
1.0.1e. The source code defines SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS as
0x00000800L and several tests are made for this value in the code. The CHANGES
mentions though that this had some side effects, the option now being part of
SSL_OP_ALL. It would look like, from the scan, that the fragments are not
enabled by default, could it be ?
Yep, for some silly reason,
SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS was/is included in
the default value SSL_OP_ALL. This is in the same
header as SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS.
The proper solution, as just about everybody knows
by now would have been to insert 1-byte fragments
(known as the 1/n-1 solution) which some other
SSL/TLS implementations do.
Enjoy
Jakob
--
Jakob Bohm, CIO, Partner, WiseMo A/S. http://www.wisemo.com
Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10
This public discussion message is non-binding and may contain errors.
WiseMo - Remote Service Management for PCs, Phones and Embedded
_______________________________________________
openssl-users mailing list
To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users
