A good summary of the possible fixes is here: http://www.ietf.org/mail-archive/web/tls/current/msg03943.html http://www.ietf.org/mail-archive/web/tls/current/ms

A good summary of the possible fixes is here: http://www.ietf.org/mail-archive/web/tls/current/msg03943.html http://www.ietf.org/mail-archive/web/tls/current/msg03943.ht... The best approach is the one advocated by ESR's internet draft, namely binding sessions to IDs better. http://www.ietf.org/mail-archive/web/tls/current/msg03963.html http://www.ietf.org/mail-archive/web/tls/current/msg03963.ht... This flaw is a result of layering within SSL. The client key exchange component carefully verified the user and the record protocol protected the data, but no one checked the binding between the two. I'm aghast. Both the client and server should reject data sent before the client/server key exchange if authentication is required. There should be no protocol state transition edge for "session -> data1 -> authenticated session -> data2". I can think of no good reason to mix the two.