3 ms·
Probably none. Especially when you see mentioned in the article that chromium makes sure their ClientHello is not in the 256-512b range to avoid breaking F5 ser
by discreditable 10y ago
Probably none. Especially when you see mentioned in the article that chromium makes sure their ClientHello is not in the 256-512b range to avoid breaking F5 servers. https://bugs.chromium.org/p/chromium/issues/detail?id=315828 https://bugs.chromium.org/p/chromium/issues/detail?id=315828
- pfg 10y agoMaybe I'm missing something, but I don't see how these issues are related. One is a compatibility workaround, the other is a vulnerability that exposes server memory to a remote attacker.
- discreditable 10y agoF5's poor coding practices are the common denominator.
- cesarb 10y agoThe cause of that particular bug was that a ClientHello in that size range looked like a SSL2 (!) handshake, and these boxes were looking for a SSL2 handshake before looking for a SSL3 handshake: https://www.ietf.org/mail-archive/web/tls/current/msg10423.html https://www.ietf.org/mail-archive/web/tls/current/msg10423.h... Interestingly, this new "ticketbleed" vulnerability could completely erradicate that bug, in the quite probable case that all versions of the F5 software which fix ticketbleed also have the much older fix for that ClientHello bug.
- kayfox 10y agoThe SSL2 issue was fixed in 11.2.1 HF11 and 11.4.0, so it should be long fixed in all supported versions at this point.