A Secure Socket Layer/Transport Layer Security process allows the exchange of the details of a handshake after a connection is made with the server. A number of Internet connections require SSL renegotiation. Renegotiation is required for making an SSL connection when no client-server authentication is initially required. Renegotiation adds authentication details to the current connection, rather than dropping and creating a new SSL connection.
There are many servers that do not properly associate renegotiation handshakes with an existing connection. This bug will allow an attacker to insert malicious data into HTTPS sessions and possibly other types of sessions protected by TLS or SSL.
Impact
This vulnerability can be exploited by Man-in-the-middle attackers. A man-in-the-middle attack is a client vulnerability with disastrous power in cryptography and computer security world. It is an attack in which the attacker secretly monitors and alters the communication between two parties.
Mitigation / Precaution
Beagle recommends the following fixes:-
- Upgrade the OpenSSL to the latest version.
