Feeds

SSL toolkit flaw poses risk

RSA patch

  • alert
  • submit to reddit

Beginner's guide to SSL certificates

A vulnerability has been discovered in versions of software development toolkits from RSA Security, which could allow an attacker to bypass SSL client authentication.

In a security notice on the issue, RSA said the vulnerability meant that hackers "might potentially gain access to data intended only for authorised users". The company has a patch and it advises customers to apply this to affected software.

Due to a bug in the SSL (Secure Socket Layer) session cacheing feature implemented in RSA BSAFE SSL-J versions 3.x, unauthorised clients may be able to impersonate authorised clients, RSA confirms.

The problem does not affect clients nor does it impact the performance of servers which do not use client authentication. But the vulnerability is noteworthy because it affects commonly used-cryptographic protection techniques.

It's been discovered that (with use of the vulnerable software libraries) if an error occurs while the handshake is being performed, the session key is, under certain conditions, stored in the cache when it should be discarded.

Once cached, this session key can be used by an attacker to cause a server to skip the full client authentication scheme, and use a much shorter sign-on procedure.

The SSL protocol provides for caching of SSL sessions between subsequent connections by the same user; this speeds up connections and lower processing overhead in most cases. The flaw would not give a user root access to a server.

The issue affects RSA BSAFE SSL-J 3.0, 3.01 and 3.1 and Cisco Internet Content Distribution Network 2.0 (because of its use of the toolkit). Users of RSA BSAFE SSL-J 1.x and 2.x are unaffected, as are RSA customers using BSAFE SSL-J 3.1.1 or 4.0 beta 2 and higher. ®

External links

RSA Security Bulletin
Cisco advice to iCDN network

Related Stories

Secure the Wireless Network firmware
RSA poses $200,000 crypto challenge
RSA takes a long-term risk on safety
Internet security firm RSA's Web site hacked

Intelligent flash storage arrays

More from The Register

next story
Knock Knock tool makes a joke of Mac AV
Yes, we know Macs 'don't get viruses', but when they do this code'll spot 'em
Shellshock over SMTP attacks mean you can now ignore your email
'But boss, the Internet Storm Centre says it's dangerous for me to reply to you'
Why weasel words might not work for Whisper
CEO suspends editor but privacy questions remain
Feds seek potential 'second Snowden' gov doc leaker – report
Hang on, Ed wasn't here when we compiled THIS document
DEATH by PowerPoint: Microsoft warns of 0-day attack hidden in slides
Might put out patch in update, might chuck it out sooner
China is ALREADY spying on Apple iCloud users, claims watchdog
Attack harvests users' info at iPhone 6 launch
prev story

Whitepapers

Choosing cloud Backup services
Demystify how you can address your data protection needs in your small- to medium-sized business and select the best online backup service to meet your needs.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
New hybrid storage solutions
Tackling data challenges through emerging hybrid storage solutions that enable optimum database performance whilst managing costs and increasingly large data stores.
Business security measures using SSL
Examines the major types of threats to information security that businesses face today and the techniques for mitigating those threats.