Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
SSL/TLS Suffers 'Bar Mitzvah Attack'
Newest First  |  Oldest First  |  Threaded View
Ranjan2003
50%
50%
Ranjan2003,
User Rank: Apprentice
2/1/2020 | 10:50:11 AM
Re: Legacy Uses?
Hi,
Your article is very informative and has a lot of information. I really like your effort, keep posting
SgS125
50%
50%
SgS125,
User Rank: Ninja
3/30/2015 | 9:58:24 AM
RC4
It is easy to not use it.

You simply remove it as an option from your list of availeable cyphers.

The troubling part is that to exploit alot of these weakneses in the past you would have been a nation state player or had access to MITM data points.  Now you just need access to the data stream and some gear to do some computing.  So as the playing field levels down to the criminals ability to have nation state capabilities we finally decide we have to fix the problem so we don't get robbed and lose some real money.

 

Sadly we did not care if we were spied on, now we care that we can be robbed.
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
3/27/2015 | 2:04:44 PM
Re: Legacy Uses?
What's most interesting here is how these outdated -- and weak -- options continue to be included in SSL/TLS implementations. There may be a legacy or backwards-compatibility reason, but the bottom line is that it leaves users and companies vulnerable. The good news is the next version of TLS aims to be a leaner, meaner spec that doesn't carry this type of baggage. Of course, in the meantime, older versions remain vulnerable. 
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
3/27/2015 | 1:52:34 PM
Legacy Uses?
What still uses RC4 (business case)? If its no longer needed I don't see why an update shouldn't be sought out to remove it?


Malicious USB Drive Hides Behind Gift Card Lure
Dark Reading Staff 3/27/2020
How Attackers Could Use Azure Apps to Sneak into Microsoft 365
Kelly Sheridan, Staff Editor, Dark Reading,  3/24/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
State of Cybersecurity Incident Response
State of Cybersecurity Incident Response
Data breaches and regulations have forced organizations to pay closer attention to the security incident response function. However, security leaders may be overestimating their ability to detect and respond to security incidents. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-10940
PUBLISHED: 2020-03-27
Local Privilege Escalation can occur in PHOENIX CONTACT PORTICO SERVER through 3.0.7 when installed to run as a service.
CVE-2020-10939
PUBLISHED: 2020-03-27
Insecure, default path permissions in PHOENIX CONTACT PC WORX SRT through 1.14 allow for local privilege escalation.
CVE-2020-6095
PUBLISHED: 2020-03-27
An exploitable denial of service vulnerability exists in the GstRTSPAuth functionality of GStreamer/gst-rtsp-server 1.14.5. A specially crafted RTSP setup request can cause a null pointer deference resulting in denial-of-service. An attacker can send a malicious packet to trigger this vulnerability.
CVE-2020-10817
PUBLISHED: 2020-03-27
The custom-searchable-data-entry-system (aka Custom Searchable Data Entry System) plugin through 1.7.1 for WordPress allows SQL Injection. NOTE: this product is discontinued.
CVE-2020-10952
PUBLISHED: 2020-03-27
GitLab EE/CE 8.11 through 12.9.1 allows blocked users to pull/push docker images.