This vulnerability involves three attack scenarios, two of which leverage server-initiated SSL ciphersuite renegotiations and one, the most dangerous of the three, which involves a client-initiated SSL ciphersuite renegotiation that is induced by the attacker. The vulnerabilities allow the attacker to prepend data to the client's initial transmission or request. This attack could be use to compromise the security of Web sites that are expected to be protected through SSL/HTTPS.  However, most Web applications, and especially those that might have implemented some type of application-level protection against cross-site request forgery, are unlikely to be configured in a way that is vulnerable to this kind of attack (for more details, see this blog post on FrequencyX.)

In addition, exploitation of this vulnerability requires a man-in-the-middle attack, so attackers must have some way of getting into the traffic stream between the victim client and server. Getting in the middle is easy to accomplish on an open wireless network at an airport or hotel, or on ethernet networks with arp cache poisoning tools such as Cain & Abel or dsniff. Attacks on network infrastructure such as routers or DNS servers could also be leveraged to successfully exploit this issue. Because of the complexity associated with man-in-the-middle attacks, they are not usually widespread.

Multiple implementations of the Transport Layer Security (TLS) protocol, including SSL, could provide weaker than expected security, caused by TLS handshake renegotiation. A remote attacker could exploit this vulnerability via man-in-the-middle techniques to inject data into the beginning of the application protocol stream to execute HTTP transactions, bypass authentication and possibly launch further attacks against the victim.

Some patches are available that provide a partial fix for this issue (disabling renegotiation, which might affect interoperability in some applications). See References for details.