from reading the TLS 1.1 RFC, it looks like it would be possible to break a previously recorded TLS <1.2, 512-bit DHE ServerKeyExchange and then send it (unmodified, with the original, valid signature) to a client that still accepts TLS <1.2 and 512-bit DHE to impersonate a server that has since been fixed (disabling DHE and/or TLS <1.2 entirely) or "fixed" (using a larger DH group). TLS 1.2 seems like it would be immune to this attack, since its ServerKeyExchange signature includes the ClientRandom value. is there something i'm missing, or would this actually work?
TLSv1.1 doesn't have a different treatment of the key-exchange parameters than TLSv1.2 has. It's just a little less obvious.
Let's dig into TLSv1.1 specification.
On page 44 you'll find that
ServerKeyExchange consists of
ServerXXXParams params and
Signature signed_params. Now on page 44 you'll actually find a definition of
Signature. This definition signs
sha_hash with or without
md5_hash. Now look at the definition of
md5_hash. It states that
MD5(ClientHello.random + ServerHello.random + ServerParams) is the definition for
md5_hash and that
SHA(ClientHello.random + ServerHello.random + ServerParams) is the definition of
Now you've found the random values you're looking for and hence this is the same methodology as in TLSv1.2, but there the signature is directly applied and arbitrary hash-functions can be used.