Re: SSL renegociation vulnerability

[christos%astron.com@localhost (Christos Zoulas)]

In article <20091204162709.GA11270%panix.com@localhost>,
Thor Lancelot Simon  <tls%panix.com@localhost> wrote:
>On Fri, Dec 04, 2009 at 01:13:52AM -0500, Brian Seklecki wrote:
>> 
>> However, I can confirm that:
>> 
>>   http://security.FreeBSD.org/patches/SA-09:15/ssl.patch
>
>If this is the patch from OpenSSL 0.9.8l it should not be applied to
>NetBSD; it is broken and introduces both forward *and* backwards API
>and ABI incompatibility.

Unfortunately I have not seen anything in the head of the OpenSSL tree
that addresses this issue so I have applied a similar patch to FreeBSD
that disables renegotiation completely for now. I would like to have
a better solution, but I don't see one.

christos