Ticketbleed F5 bug undermines HTTPS

#1

Post by beaconfield » Fri, Feb 10, 2017, 1:34 AM UTC

Ticketbleed F5 bug undermines HTTPS
arstechnica.com

Re: Ticketbleed F5 bug undermines HTTPS

#2

Post by jsnfwlr » Fri, Feb 10, 2017, 1:52 AM UTC

Thankfully this is limited to a single (and seemingly small) company's hardware, rather than the entire SSL/TLS stack. Glad it wasn't someone like Cisco too ...

Re: Ticketbleed F5 bug undermines HTTPS

#3

Post by meowface » Fri, Feb 10, 2017, 2:14 AM UTC

jsnfwlr wrote: post #2

Thankfully this is limited to a single (and seemingly small) company's hardware, rather than the entire SSL/TLS stack. Glad it wasn't someone like Cisco too ...

True, but F5 is still extremely popular with medium and large companies.

Re: Ticketbleed F5 bug undermines HTTPS

#4

Post by bsagdiyev » Fri, Feb 10, 2017, 2:41 AM UTC

jsnfwlr wrote: post #2

Thankfully this is limited to a single (and seemingly small) company's hardware, rather than the entire SSL/TLS stack. Glad it wasn't someone like Cisco too ...

We had session tickets disabled already so weren't affected, but you'd be surprised some of the sites that use these devices. I believe AT&T has quite a number in use.

Re: Ticketbleed F5 bug undermines HTTPS

#5

Post by synicalx » Fri, Feb 10, 2017, 3:42 AM UTC

jsnfwlr wrote: post #2

Thankfully this is limited to a single (and seemingly small) company's hardware, rather than the entire SSL/TLS stack. Glad it wasn't someone like Cisco too ...

I wouldn't say F5 is small, in fact for load balancing (or whatever the kids call that these days) they're over 50% of the market apparently - https://f5.com/about-us/news/twists/f5-gains-adc-market-shar...

Re: Ticketbleed F5 bug undermines HTTPS

#6

Post by zonknz » Fri, Feb 10, 2017, 3:46 AM UTC

bsagdiyev wrote: post #4

jsnfwlr wrote: post #2

Thankfully this is limited to a single (and seemingly small) company's hardware, rather than the entire SSL/TLS stack. Glad it wasn't someone like Cisco too ...

We had session tickets disabled already so weren't affected, but you'd be surprised some of the sites that use these devices. I believe AT&T has quite a number in use.

At one time Azure was built on a whole bunch of F5s. Unsure if they are still in the picture.

Re: Ticketbleed F5 bug undermines HTTPS

#7

Post by trome » Fri, Feb 10, 2017, 4:00 AM UTC

zonknz wrote: post #6

bsagdiyev wrote: post #4

Earlier quoted context omitted.

We had session tickets disabled already so weren't affected, but you'd be surprised some of the sites that use these devices. I believe AT&T has quite a number in use.

At one time Azure was built on a whole bunch of F5s. Unsure if they are still in the picture.

F5 is just across the water from Microsoft, and there is a lot of cross-pollination of employees between the two. Even if F5 wasn't the best choice, I wouldn't be surprised if they were used just due to familiarity.