|
Naziv
|
Exploiting Incorrectly Configured SSL
|
|
Sažetak
|
An adversary takes advantage of incorrectly configured SSL communications that enables access to data intended to be encrypted. The adversary may also use this type of attack to inject commands or other traffic into the encrypted stream to cause compromise of either the client or server.
|
|
Preduvjeti
|
Access to the client/server stream.
|
|
Rješenja
|
Usage of configuration settings, such as stream ciphers vs. block ciphers and setting timeouts on SSL sessions to extremely low values lessens the potential impact. Use of later versions of TLS (e.g. TLS 1.1+) can also be effective, but not all clients or servers support the later versions.
|
