Windows fix for TLS security bug still forthcoming, won't be Tuesday

The question over whether Secure Sockets Later, and later Transport Layer Security, was ever sufficiently impregnable never rose to such a crescendo for malicious users to become inspired to exploit it. In the end, the discovery that TLS had a weak spot was made by a security engineer, PhoneFactor engineer Marsh Ray, last month. It was when other engineers started tweeting about themselves being possibly on the verge of the same discovery, that Ray felt he had to go public to encourage everyone else to hush.

Now that the news of TLS' latent vulnerability is public, the threat of a possible exploit is real. Such an exploit, if discovered, could effectively negate the encryption system used to protect essentially every credit card transaction on the Web. And Ray and partner Steve Dispensa have been sounding the alarm with regard to other conceivable permutations of the man-in-the-middle mechanism, including forging a user's Twitter credentials.

As the above-linked blog post from Ray and Dispensa indicates, a lot of what they've been receiving in return is downplaying and damage control from the likes of IBM. Nontheless, a coordinated response to the SSL problem from multiple vendors, including Microsoft, is in the works, according to a Microsoft spokesperson Monday evening -- an effort that appears to have been modeled against the largely successful response to researcher Dan Kaminsky's discovery in summer 2008 of a serious flaw in the Internet's DNS scheme.

"Microsoft is aware of claims of vulnerabilities affecting the Transport Layer Security specification that could potentially lead to man-in-the-middle attacks," the spokesperson told Betanews. "We are investigating these claims for any possible impact on Microsoft's implementations of the standard. As an issue potentially affecting an Internet standard, we recognize this issue potentially affects multiple vendors, and Microsoft is working with its partners in the Internet Consortium for Advancement of Security on the Internet (ICASI) on a coordinated response."

Last month, ICASI acknowledged having been contacted by Ray and Dispensa's employer, PhoneFactor, about their discovery. Since that time, member vendors have acknowledged the critical nature of the issue, and both Cisco and Juniper Networks have issued advisories.

"Successful exploitation could allow an attacker to inject data into a legitimate SSL/TLS-protected session and trigger a renegotiation," reads Cisco's latest advisory, updated last Friday. "This may allow the attacker to execute operations on the server using the client's credentials but does not allow the attacker to read, decrypt, or alter encrypted traffic between client and server. While the vulnerability exists within the TLS protocol, the impact of an attack depends on the application protocol running over TLS."

No vendor has released a patch just yet, but the reason for that may be because all ICASI vendors may need to deploy patches in the field simultaneously for any of them to be effective.

"Once we're done investigating, we will take appropriate action to help protect customers," Microsoft's spokesperson told us Monday evening. "This may include providing a security update through the monthly release process, an out-of-cycle update, or additional guidance to help customers protect themselves."