Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have -MultiViews set and SSLInsecureNegotation off ( in ifmodule of mod_ssl.c) in Apache.

But still vulnerability report says I am vulnerable to client side negotiation and "This server is vulnerable to MITM attacks because it supports insecure renegotiation".

Any pointers ?

The same configuration works on our TEST environments. THe only difference is the build release versions.

The systems where it is vulnerable has 31 around release build and in our TEST environment we have 53 release build version)

All on apache 2.2.3 (Oracle provided)

Thanks !

share|improve this question

You must update httpd to version 2.2.3-31 or later to mitigate this vulnerability. See RHSA 2009:1579 for details.

(Note that the latest release as of this writing is 2.2.3-76.)

share|improve this answer
If thats the case, then it should work in our live environment as there we have 2.2.3-31 – Novice User Jan 12 '13 at 9:02

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.