Hi,
A colleague and I have released details of a new attack against TLS
in the
area of renegotiation. Information is here:
http://extendedsubset.com/?p=8
During the process of running this bug (and its proposed solution) to
ground, I implemented a patch to GNUTLS, attached. There are also
two new
files that implement the extension that solves the problem.
There is lots of background in the above link, but the one missing
part is
the Internet Draft that has been tentatively agreed on by most of
the major
vendors (pending IETF action, of course). That draft is what I have
implemented, and you should see it posted to the TLS IETF list
tomorrow
morning.