Subject: [TLS] MS12-006 released

From: Yuhong Bao <[email-masked]>
Date: Thu, 12 Jan 2012 23:29:58 -0800

Have anyone took a look at it?

Yuhong Bao

---

From: Marsh Ray <[email-masked]>
Date: Fri, 13 Jan 2012 09:44:25 -0600

> Have anyone took a look at it?

http://technet.microsoft.com/en-us/security/bulletin/ms12-006

Links to

http://technet.microsoft.com/en-us/security/advisory/2588513

which links to

http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3389

the BEAST attack.

I haven't looked at it on the wire, but my understanding is that 
Microsoft's patch is a "one byte record" fix similar to the other 
implementations.

- Marsh

---

From: Adam Langley <[email-masked]>
Date: Fri, 13 Jan 2012 10:47:08 -0500

On Fri, Jan 13, 2012 at 10:44 AM, Marsh Ray <[email-masked]> wrote:
> I haven't looked at it on the wire, but my understanding is that Microsoft's
> patch is a "one byte record" fix similar to the other implementations.

>From looking at packet dumps, the SChannel change appears to be
exactly the same 1/n-1 record splitting as implemented in Chrome 16
and Firefox 10. http://support.microsoft.com/kb/2643584 describes how
it's off by default (per a registry setting), but that IE explicitly
enables it.

Cheers

AGL

---

From: Yuhong Bao <[email-masked]>
Date: Sat, 14 Jan 2012 20:06:56 -0800

> On Fri, Jan 13, 2012 at 10:44 AM, Marsh Ray  wrote:
But I am particularly thinking of the "incorrect version checking on the premaster secret" bug.

Yuhong Bao