SSL/TLS Authentication Gap (SSL Gap)

• A major vulnerability in SSL authentication was discovered in August of 2009 by security analysts at PhoneFactor.
• The resulting authentication gap allows an attacker to inject himself into the authenticated SSL communications path in a standard man-in-the-middle attack.
• Most websites that use SSL are potentially affected. Affected scenarios include web surfers doing online banking, back-office systems using web services-based protocols, and non-HTTP applications such as some mail servers, database servers, and so on.
• The vulnerability partially invalidates the SSL lock, which users rely on to verify that their communications with a website are secure.
• Websites using client certificates (including many smart card deployments) are affected.
• All SSL libraries will need to be patched. Software vendors will have to update their software to support the library revisions, and users will have to update any SSL-protected software as patches become available.

Situation:
Marsh Ray and Steve Dispensa, both of PhoneFactor, demonstrated the vulnerability to a working group of affected vendors, together with representatives from the appropriate standards committees, in Mountain View, CA, on September 29, 2009. The group reached a preliminary agreement on how to address the underlying issue with the standard and patch the SSL libraries and also began work on a set of recommended methods for mitigating the vulnerability.

The working group included: PhoneFactor; Industry Consortium for the Advancement of Security on the Internet (ICASI) members – Microsoft, Intel, Nokia, IBM, Cisco and Juniper; Open SSL; Apache; NSS; Red Hat; Leviathan Security Group; and representatives from the Internet Engineering Task Force (IETF).

PhoneFactor volunteered to delay disclosure of the vulnerability until at least early 2010 to allow time for vendors to make the necessary patches available. However, a closely related discussion thread on the IETF TLS working group mailing list independently uncovered the problem on November 4th. News of the vulnerability quickly spread through the IT security community.

Details:
A serious vulnerability in SSL, an extremely common data security protocol on the Internet, was discovered by Marsh Ray and Steve Dispensa of PhoneFactor. The SSL authentication gap allows an attacker to mount a man-in-the-middle attack, and affects the majority of SSL-protected servers on the Internet. Specifically, the vulnerability allows the attacker to inject malicious data and commands into the authenticated SSL communications path. This can often be done without either the client or server (e.g. web server and browser) being able to detect the attack.

The vulnerability results from a weakness in the SSL protocol standard (formally known as Transport Layer Security, or TLS). As such, most SSL implementations are vulnerable in one way or another. Affected scenarios include web surfers doing online banking, back-office systems using web services-based protocols, and non-HTTP applications such as some mail servers, database servers, and so on.

Because this is a protocol vulnerability, and not merely an implementation flaw, the impacts are far-reaching. All SSL libraries will need to be patched, and most client and server applications will, at a minimum, need to include new copies of SSL libraries in their products. Most users will eventually need to update any software that uses SSL.

To address the issue, the PhoneFactor team organized a working group of affected vendors, together with representatives from the appropriate standards committees. The group reached a consensus on how to address the underlying issue with the SSL Standard and patch the SSL libraries and also created a set of recommended methods for mitigating the vulnerability.

A case has been opened with CERT (VU#120541).

Current Status:
A new SSL protocol (RFC 5246) is now in place, which has been implemented by most of the larger vendors without any know exploits having taken place. A comprehensive list of vendor patches is available at http://www.phonefactor.com/sslgap/ssl-tls-authentication-patches.