[upki-odcert:25] SSL/TLSリネゴシエーション問題について

[Takeshi NISHIMURA <xxxxxxx@xxxxxxxxx>]

西村です。

2009年11月に公開になった、SSL/TLSプロトコルのリネゴシエーション
(renegotiation, 再ネゴシエーション)の問題について、各ブラウザ
での対応も出てきたようですが、ひとまず私が集めたリンクを提供します。

全体:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3555
https://www.kb.cert.org/vuls/id/120541
http://www.st.ryukoku.ac.jp/~kjm/security/memo/2009/11.html#20091106_TLS

主に原因・影響について:
http://www.phonefactor.com/sslgap
http://www.openssl.org/news/secadv_20091111.txt
http://www.securegoose.org/2009/11/tls-renegotiation-vulnerability-cve.html
http://blogs.iss.net/archive/stealingcookieswiths.html
http://www.g-sec.lu/practicaltls.pdf
http://www.tombom.co.uk/blog/?p=85
http://www.schneier.com/blog/archives/2009/12/reacting_to_sec.html
http://www.st.ryukoku.ac.jp/~kjm/security/ml-archive/full-disclosure/2009.11/msg00062.html
http://www.jpcert.or.jp/wr/2009/wr094401.html#3
http://japan.cnet.com/news/sec/story/0,2000056024,20403071,00.htm
http://www.itmedia.co.jp/enterprise/articles/0911/09/news015.html
http://www.itmedia.co.jp/enterprise/articles/0911/17/news021.html
https://www.netsecurity.ne.jp/1_14422.html

主に対策・対応について:
RFC
  http://www.rfc-editor.org/rfc/rfc5746.txt
OpenSSL
  http://www.openssl.org/news/changelog.html
  http://cvs.openssl.org/fileview?f=openssl-web/news/announce.txt&v=1.52
  http://cvs.openssl.org/fileview?f=openssl-web/news/announce.txt&v=1.53
Firefox
  https://developer.mozilla.org/NSS_3.12.5_release_notes
  https://wiki.mozilla.org/Security:Renegotiation
  https://bugzilla.mozilla.org/show_bug.cgi?id=535649
  ftp://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/latest-mozilla-central/
  https://ssltls.de/renego.php
  https://bugzilla.mozilla.org/show_bug.cgi?id=526689
  https://bugzilla.mozilla.org/show_bug.cgi?id=537356
Opera
  http://my.opera.com/securitygroup/blog/2010/01/23/alpha-testing-tls-renego-fix
Red Hat
  http://kbase.redhat.com/faq/docs/DOC-20491
  https://rhn.redhat.com/errata/RHSA-2009-1579.html
  https://rhn.redhat.com/errata/RHSA-2010-0011.html
  https://rhn.redhat.com/errata/RHSA-2009-1580.html
  https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2009-3555
Ubuntu
  http://www.ubuntu.com/usn/USN-860-1
  http://gihyo.jp/admin/clip/01/ubuntu-topics/200911/0027
FreeBSD
  http://security.freebsd.org/advisories/FreeBSD-SA-09:15.ssl.asc
OpenBSD
  http://openbsd.org/errata46.html#004_openssl
  http://openbsd.org/errata45.html#010_openssl
Solaris他
  http://blogs.sun.com/security/entry/vulnerability_in_tls_protocol_during
  http://jp.sunsolve.sun.com/search/document.do?assetkey=1-66-273029-1
  http://jp.sunsolve.sun.com/search/document.do?assetkey=1-66-273350-1
  http://jp.sunsolve.sun.com/search/document.do?assetkey=1-66-274990-1
  http://software.fujitsu.com/jp/security/vulnerabilities/vu120541.html
Windows
  http://blogs.technet.com/srd/archive/2010/02/09/details-on-the-new-tls-advisory.aspx
  http://support.microsoft.com/kb/977377/ja
Mac OS X
  http://support.apple.com/kb/HT4004?viewlocale=ja_JP&locale=ja_JP
  http://itpro.nikkeibp.co.jp/article/COLUMN/20100127/343809/
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002319.html
http://www.phonefactor.com/sslgap/ssl-tls-authentication-patches

-- 
西村健
国立情報学研究所 TEL:03-4212-2720