Secure testing team - Jan 2011 - Bug#611461: iceweasel still does insecure ssl renegotiation?!

Package: iceweasel
Version: 3.5.16-4
Severity: grave
Tags: security
Justification: user security hole


Hi.

It seems that iceweasel still is vulnerable to the SSL renegotiation attack,
as simply is configured per default to allow the vulnerable renegotiation:
security.ssl.require_safe_negotiation;true


Cheers,
Chris.