Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The details are here:

One recommendation per post please.

share|improve this question
Maybe this should be a wiki? – sybreon Jul 30 '09 at 12:08
up vote 3 down vote accepted

Use FireFox 3.5 which is apparently1 not vulnerable.

(In the end, all SSL clients will need to update to ignore null for null characters when checking the host name of the certificate matches.)

1 According to this article on The Register (final paragraph).

share|improve this answer
null-terminated strings are a fixture of C, and possibly other languages. – sybreon Jul 30 '09 at 16:07

This is not really a solution and more of a discussion kick-off.

It can be mitigated by reducing the reliance on SSL. What I means is that we should not rely on SSL only and assuming that all SSL connections are secure. The hack essentially allows MITM attacks from being detected by the user.

Maybe, the way to work around it is by avoiding any transmission of sensitive information through the connection.


Instead of transmitting login passwords through SSL, have the password hashed at the client and with some sort of salt issued by a challenge and then transmit that through SSL. Also, using some sort of OTP generator like some banks use, is a good idea.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.