SSL serverHello message length tampered -
in ssl client, receiving serverhello message tampered message length below.
"16 03 00 00 35 02 00 08 00... "
here, "00 08 00" message length coming 2048 bytes. in next record, sends "servercertificate & serverhellodone" messages.
so, in client side, waits read 2048 bytes. messages "serverhello, servercertificate, serverhellodone" not having 2048 bytes combinedly. so, still client waits read pending message (socket blocking socket). so, waits in recv , never comes out.
i know how applications should handle situation. there way in ssl protocol, can identify this. if not possible, how applications should handle situation come out ?
thank !
regards satish.
Comments
Post a Comment