Does ASL protect from this DDoS?

BruceLee · **Posted:** Thu Oct 27, 2011 6:30 am

New DDoS tool. The tool exploits a weakness in SSL to kick a server off the Internet.

http://thehackerschoice.wordpress.com/2011/10/24/thc-ssl-dos/

Thanks

mikeshinn · **Posted:** Thu Oct 27, 2011 9:20 pm

No need, its a an old old old SSL vulnerability. It can only happen if you have renegotiation enabled, which not only shouldnt you do, but newer browsers wont even support it and will fail the SSL connection.

http://httpd.apache.org/docs/2.0/mod/mo ... egotiation

You have to enable this in apache:

"If this directive is enabled, SSL connections will be vulnerable to the Man-in-the-Middle prefix attack as described in CVE-2009-3555."

If your apache has this enabled, disable it.

BruceLee · **Posted:** Fri Oct 28, 2011 2:50 am

Thanks. Just wanted to make sure.

Does ASL protect from this DDoS?

Who is online