Subject: [TLS] Concrete examples of TLS-intolerant servers

From: Wan-Teh Chang <[email-masked]>
Date: Fri, 11 Dec 2009 14:09:13 -0800

The following information was accurate as of yesterday, 2009-12-10.
All information is public, coming from Google Chrome bug reports.

I identify the servers by their behavior and by the Server headers
in the HTTP responses.

I tested the servers using Mac OS X 10.5 (TLS 1.0 without extensions)
and Windows Vista (TLS 1.0 with extensions) and inspected the
handshake messages.  I didn't test TLS 1.1 or 1.2.

1. https://militarybankonline.bankofamerica.com/efs/servlet/military/login.jsp
"Server: IBM_HTTP_Server/6.0.2.15 Apache/2.0.47 (Unix) DAV/2"
Intolerant of TLS extensions.  Respond by closing the TCP connection
without sending TLS alerts.

Update: Today (2009-12-11) this server properly ignores TLS extensions
and identifies itself as
"Server: IBM_HTTP_Server/6.0.2.33 Apache/2.0.47 (Unix) DAV/2"

2. https://www.cdep.ro/
Server unknown because SSL client auth is required.
Intolerant of TLS extensions.  Respond with an illegal_parameter alert.

3. https://welcome27.co-operativebank.co.uk/CBIBSWeb/start.do
"Server: IBM_HTTP_Server"
Intolerant of TLS extensions.  Respond by closing the TCP connection
without sending TLS alerts.

4. https://stud.infostud.uniroma1.it:4445/Sest/Log/Corpo.html
"Server: OracleAS-Web-Cache-10g/10.1.2.0.2"
Intolerant of TLS.  Respond with an (SSL 3.0) unexpected_message alert.

5. https://www.bankalbilad.com.sa/retail/logon.do
"Server: Bab web server"
Intolerant of TLS.  Respond with an (SSL 3.0) handshake_failure alert.

6. Oracle Application Server
"Server: Oracle-Application-Server-10g/10.1.2.0.2 Oracle-HTTP-Server"
Intolerant of TLS extensions.  Respond with an illegal_parameter alert.

7. https://www.sbbt.com/personal-home.php
"Server: IBM_HTTP_Server"
Intolerant of TLS extensions.  Respond by closing the TCP connection
without sending TLS alerts.

Wan-Teh Chang

---

From: Stephen Farrell <[email-masked]>
Date: Sat, 12 Dec 2009 19:33:54 +0000

So that's 7-1 (fixed) = 6 extension intolerant servers out of
how many?

Hard to decide what this means otherwise.

S.

Wan-Teh Chang wrote:
> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls
>

---

From: Yoav Nir <[email-masked]>
Date: Sun, 13 Dec 2009 10:04:16 +0200

I guess it at least indicates that sites using IBM_HTTP_Server or "OracleAS" server may have a problem unless (in the case of IBM) they're updated.

Another thing is that if banks are like that, it's very likely that we'll find a lot of others, in companies that don't have a "security department" like banks do.

On Dec 12, 2009, at 9:33 PM, Stephen Farrell wrote:

> Scanned by Check Point Total Security Gateway.