Slashdot Mirror
OpenSSL Security Update
Pseud0 writes "Just announced on the OpenSSL announce mailing list. The affected versions are "[...] OpenSSL 0.9.6d or earlier, or 0.9.7-beta2 or earlier or current development snapshots of 0.9.7 to provide SSL or TLS is vulnerable, whether client or server. 0.9.6d servers on 32-bit systems with SSL 2.0 disabled are not vulnerable." Get your updates here."
SSL sucks! cheese! want some shoes?
CSLib forever!!! w00t!
if product_type(os(bug))="microsoft" then
"M$ suxx0r!"
elseif product_type(os(bug))="*n?x" then
"Isn't our beloved OS wonderful? Look how quickly the bugs are fixed."
endif
I Like pie.
Blah
sigh
- firstpost.
It seems that by throwing secure at the end of something cons ppl into thinking its secure, ssh, ssl and who know how many encryption methods have been cracked. Face it, Security is a Fallacy.
Analytic & algebraic topology of locally Euclidean meterization of infinitely differentiable Riemmanian manifold
Wait, what, WHAT? Back up. This sounds really bad. Is it? What is going on here? The OpenSSL page is being all slashdotted-y, but it seems to be saying there were at least three buffer overflow exploits in some versions of OpenSSL? Um. How much do i worry about this?
:)
Basically, I don't understand all this blathering about versions. I have this here linux server i'm SSHed into. It's running slackware, but that shouldn't be important. Tell me how to type stuff into the command line and figure out whether i have an exploitable SSL and need to upgrade.
Doesn't OpenSSH rely on OpenSSL to function? What exactly does OpenSSL do in that capacity? Does this mean the openbsd "no remote root exploits in the default distribution" thing's been violated again?
Does anyone out there have more information on the vunerability? The site is /.'d
OK, lets announce a major secuirty whole in a prouct that a good chunk of people use, then link to their website so that no one can download the patch(es).
/.
Yeah... Real smart.
Honestly, when I want security updates, I'll read BUGTRAQ, when I want light fluff about the latest Stallman-ism, I'll read
(Still, if you want to do this, add a security section or something, jeez)
Objects in the blog are closer then they ap
Notice how with Free Software we get the security notice and the fix for it at the same time. Thanks to "many eyes," no sooner is a flaw detected than it is patched up! Meanwhile, Micro$oft covers up its security holes and then denies they exist when servers start getting rooted (or Administratored, rather). If there were any justice in the world, Apache would be walking all over IIS, rather than the other way around. This is the kind of thing that keeps me coming back to Linux year after year (I always reserve Good Friday for an "upgrade" to the latest Linux). With Linux on my servers and even my desktop (I find DVD menus distracting, don't play games, and never print in color, so this is acceptible), I know I can always count on being safe, stable, and secure.
Karma: Good (despite my invention of the Karma: sig)
Why do most Brits have blackish yellow rotten teeth? Even wealthy parasites like the queen and the royal family have disgusting filthy teeth. I find that and their breath really gross.
That Linux security sucks. Not to mention it's unstability, lack of a decent GUI, and lack of modern development tools. But, hey, at least it's free!
I Agree With This Post.
Need a UNIX/Linux/network guru in the Boulde
So you'd rather run ftp than sftp or telnet than ssh? It is true if someone really wants in your system they can get in one way or another. However, you should make the possibility of intrusion as difficult as possible, instead of the "it's going to get cracked anyway" attitude.
Sticking feathers up your butt does not make you a chicken - Tyler Durden
For crying out loud, how about at least putting the text of the security alert in the story. Honestly, how hard would it have been to do that? Now all I know is that there is some security issue with OpenSSL, and I can't get to the site to even see what it is. I know /. can't control the fact that sites get slashdotted, but you could be a little more considerate and give us SOME information.
My beliefs do not require that you agree with them.
engine versions incorporate support for hardware cryptographic devices.
.sig: file not found
this is *such* a pain in the arse. where do i begin?
As a poster noted, it is quite ironic that /. effectively acts as a DoS against web sites. Yes, I'm trying to download the update to OpenSSL, an excellent product that we use in our applications. No, I can't reach their site, because millions of /.ers are trying to read the site. /. did a Google? It cannot be so difficult to mirror a site and refer to that instead of the prime site? /. effect is not just really annoying and traumatic to those sysadmins exposed to it, it's unpolite, and it's unnecessary. CmdrTaco, please consider doing something smarter to mirror targetted sites.
Isn't it time that
I like reading and posting here, but the
My blog
To anyone considering using openssl in their project you should be aware that it violates the GPL.
Openssl is subversive.
need to work on your buzzwords a little tho-- you left out "FUD"
Sticking feathers up your butt does not make you a chicken - Tyler Durden
I'll put them there. Quit hammering their servers.
Doesn't OpenSSH rely on OpenSSL to function?
No.
Does this mean the openbsd "no remote root exploits in the default distribution" thing's been violated again?
No.
OpenSSL Security Advisory [30 July 2002]
A N- 2002-0655g i?name=CAN- 2002-0656g i?name=CAN- 2002-0657
A N- 2002-0659
3 0_0_9_6d. txt
7 .txt
This advisory consists of two independent advisories, merged, and is an official OpenSSL advisory.
Advisory 1
A.L. Digital Ltd and The Bunker (http://www.thebunker.net/) are conducting a security review of OpenSSL, under the DARPA program CHATS.
Vulnerabilities
All four of these are potentially remotely exploitable.
1. The client master key in SSL2 could be oversized and overrun a buffer. This vulnerability was also independently discovered by consultants at Neohapsis (http://www.neohapsis.com/) who have also demonstrated that the vulerability is exploitable. Exploit code is NOT available at this time.
2. The session ID supplied to a client in SSL3 could be oversized and overrun a buffer.
3. The master key supplied to an SSL3 server could be oversized and overrun a stack-based buffer. This issues only affects OpenSSL 0.9.7 before 0.9.7-beta3 with Kerberos enabled.
4. Various buffers for ASCII representations of integers were too small on 64 bit platforms.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2002-0656 to issues 1-2, CAN-2002-0657 to issue 3, and CAN-2002-0655 to issue 4. In addition various potential buffer overflows not known to be exploitable have had assertions added to defend against them.
Who is affected?
Everyone using OpenSSL 0.9.6d or earlier, or 0.9.7-beta2 or earlier or current development snapshots of 0.9.7 to provide SSL or TLS is
vulnerable, whether client or server. 0.9.6d servers on 32-bit systems with SSL 2.0 disabled are not vulnerable. SSLeay is probably also affected.
Recommendations
Apply the attached patch to OpenSSL 0.9.6d, or upgrade to OpenSSL 0.9.6e. Recompile all applications using OpenSSL to provide SSL or
TLS. A patch for 0.9.7 is available from the OpenSSL website (http://www.openssl.org/).
Servers can disable SSL2, alternatively disable all applications using SSL or TLS until the patches are applied. Users of 0.9.7 pre-release
versions with Kerberos enabled will also have to disable Kerberos. Client should be disabled altogether until the patches are applied.
Known Exploits
There are no know exploits available for these vulnerabilities. As noted above, Neohapsis have demonstrated internally that an exploit is
possible, but have not released the exploit code.
References
http://cve.mitre.org/cgi-bin/cvename.cgi?name=C
http://cve.mitre.org/cgi-bin/cvename.c
http://cve.mitre.org/cgi-bin/cvename.c
Acknowledgements
The project leading to this advisory is sponsored by the Defense Advanced Research Projects Agency (DARPA) and Air Force Research Laboratory, Air Force Materiel Command, USAF, under agreement number F30602-01-2-0537. The patch and advisory were prepared by Ben Laurie.
Advisory 2 Vulnerabilities
The ASN1 parser can be confused by supplying it with certain invalid encodings. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2002-0659 to this issue.
Who is affected?
Any OpenSSL program which uses the ASN1 library to parse untrusted data. This includes all SSL or TLS applications, those using S/MIME (PKCS#7) or certificate generation routines.
Recommendations
Apply the patch to OpenSSL, or upgrade to OpenSSL 0.9.6e. Recompile all applications using OpenSSL.
Users of 0.9.7 pre-release versions should apply the patch or upgrade to 0.9.7-beta3 or later. Recompile all applications using OpenSSL.
Exploits
There are no known exploits for this vulnerability.
References
http://cve.mitre.org/cgi-bin/cvename.cgi?name=C
Acknowledgements
This vulnerability was discovered by Adi Stav and James Yonan independently. The patch is partly
based on a version by Adi Stav.
The patch and advisory were prepared by Dr. Stephen Henson.
Combined patches for OpenSSL 0.9.6d:
http://www.openssl.org/news/patch_200207
Combined patches for OpenSSL 0.9.7 beta 2:http://www.openssl.org/news/patch_20020730_0_9_
URL for this Security Advisory: http://www.openssl.org/news/secadv_20020730.txt
OpenSSL Security Advisory [30 July 2002]
This advisory consists of two independent advisories, merged, and is an official OpenSSL advisory.
Advisory 1
A.L. Digital Ltd and The Bunker (http://www.thebunker.net/) are conducting a security review of OpenSSL, under the DARPA program CHATS.
Vulnerabilities
All four of these are potentially remotely exploitable.
1. The client master key in SSL2 could be oversized and overrun a buffer. This vulnerability was also independently discovered by consultants at Neohapsis (http://www.neohapsis.com/) who have also demonstrated that the vulerability is exploitable. Exploit code is NOT available at this time.
2. The session ID supplied to a client in SSL3 could be oversized and overrun a buffer.
3. The master key supplied to an SSL3 server could be oversized and overrun a stack-based buffer. This issues only affects OpenSSL 0.9.7 before 0.9.7-beta3 with Kerberos enabled.
4. Various buffers for ASCII representations of integers were too small on 64 bit platforms.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2002-0656 to issues 1-2, CAN-2002-0657 to issue 3, and CAN-2002-0655 to issue 4.
In addition various potential buffer overflows not known to be exploitable have had assertions added to defend against them.
Who is affected?
Everyone using OpenSSL 0.9.6d or earlier, or 0.9.7-beta2 or earlier or current development snapshots of 0.9.7 to provide SSL or TLS is vulnerable, whether client or server. 0.9.6d servers on 32-bit systems with SSL 2.0 disabled are not vulnerable.
SSLeay is probably also affected.
Recommendations
Apply the attached patch to OpenSSL 0.9.6d, or upgrade to OpenSSL 0.9.6e. Recompile all applications using OpenSSL to provide SSL or TLS.
A patch for 0.9.7 is available from the OpenSSL website (http://www.openssl.org/).
Servers can disable SSL2, alternatively disable all applications using SSL or TLS until the patches are applied. Users of 0.9.7 pre-release versions with Kerberos enabled will also have to disable Kerberos.
Client should be disabled altogether until the patches are applied.
Known Exploits
There are no know exploits available for these vulnerabilities. As noted above, Neohapsis have demonstrated internally that an exploit is possible, but have not released the exploit code.
References
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN- 2002-0655
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN- 2002-0656
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN- 2002-0657
Acknowledgements
The project leading to this advisory is sponsored by the Defense Advanced Research Projects Agency (DARPA) and Air Force Research Laboratory, Air Force Materiel Command, USAF, under agreement number F30602-01-2-0537.
The patch and advisory were prepared by Ben Laurie.
Advisory 2
Vulnerabilities
The ASN1 parser can be confused by supplying it with certain invalid encodings.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2002-0659 to this issue.
Who is affected?
Any OpenSSL program which uses the ASN1 library to parse untrusted data. This includes all SSL or TLS applications, those using S/MIME (PKCS#7) or certificate generation routines.
Recommendations
Apply the patch to OpenSSL, or upgrade to OpenSSL 0.9.6e. Recompile all applications using OpenSSL.
Users of 0.9.7 pre-release versions should apply the patch or upgrade to 0.9.7-beta3 or later. Recompile all applications using OpenSSL.
Exploits
There are no known exploits for this vulnerability.
References
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN- 2002-0659
Acknowledgements
This vulnerability was discovered by Adi Stav and James Yonan independently. The patch is partly based on a version by Adi Stav.
The patch and advisory were prepared by Dr. Stephen Henson.
The only Good System is a Sound System
Yeah, and the night before.. It was great.. Mmmm mmmmm.. having that cock slide between my butt cheeks was su-per du-per good. Thanks Taco...
BTW- Now I know why he calls himself Taco- his manhood smells like one after it's been on the counter for a day in a hot Alabama summer- nice 'n stinky..
BTW look in alt.bin.w.linux if you want the
0.96e openssl
and
0.96e openssl engine
(I just posted them to giganews)
The original security advisory (with attached patch for OpenSSL 0.9.6d) is here. A follow-up with patches for older versions is here.
OK -- I understand your pain -- I know that you feel it's difficult to keep up with things, especially when it seems like they aren't achieving the end they purport.
But, it's important to note here that a buffer or stack overflow is DIFFERENT than cracking the encryption algorithm used. These are buffer overflows, which introduces a DoS condition, or possible remote shell attack. The data transiting the network that is encrypted, however, is still encrypted.
Listen Michael,
/..
/."
If you are going to post something like this, then I think you should basically be man enough to mirror using your own website or use Slashdot to mirror the new OpenSSL sources and binaries.
Its completely insane, and thoughtless.. That Slashdot becomes a source of DDOS-like actions against IMPORTANT security advisories and downloads.
Now thanks to Slashdot and yourself, there is a bunch of servers that are completely left wide open now to this risk. And why?!?! Cause, we can't even access the website, due to
This has been going on for way to long, and I think that Slashdot should owe up to the responsibility of being able to host the files, or stop posting articles in regards to them, till at least a week after the initial announcement.
Ohh boy.. "I was h4x0r3d due to OpenSSL being
A ton of vendor advisories can be found at
www.cgisecurity.com
http://online.securityfocus.com/archive/1/285022/2 002-07-27/2002-08-02/0
Red Hat's servers are
Great, just great...
I downloaded the source tarball but couldn't find a PGP signature for it anywhere. Am I supposed to just trust it and install it anyway?
Here's a copy of the full advisory since the OpenSSL site is /.'d.
:~/lynx -head -dump http://www.slashdot.org
:)
HTTP/1.1 301 Moved Permanently
Date: Tue, 30 Jul 2002 14:37:05 GMT
Server: Apache/1.3.26 (Unix) mod_gzip/1.3.19.1a mod_perl/1.27 mod_ssl/2.8.10 OpenSSL/0.9.6d
time to use your own advise and update
OpenSSL Security Advisory [30 July 2002]
- 2002-0655 - 2002-0656 - 2002-0657
- 2002-0659
. txt
t xt
This advisory consists of two independent advisories, merged, and is an official OpenSSL advisory.
Advisory 1
==========
A.L. Digital Ltd and The Bunker (http://www.thebunker.net/) are conducting a security review of OpenSSL, under the DARPA program CHATS.
Vulnerabilities
---------------
All four of these are potentially remotely exploitable.
1. The client master key in SSL2 could be oversized and overrun a buffer. This vulnerability was also independently discovered by consultants at Neohapsis (http://www.neohapsis.com/) who have also demonstrated that the vulerability is exploitable. Exploit code is NOT available at this time.
2. The session ID supplied to a client in SSL3 could be oversized and overrun a buffer.
3. The master key supplied to an SSL3 server could be oversized and overrun a stack-based buffer. This issues only affects OpenSSL 0.9.7 before 0.9.7-beta3 with Kerberos enabled.
4. Various buffers for ASCII representations of integers were too small on 64 bit platforms.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2002-0656 to issues 1-2, CAN-2002-0657 to issue 3, and CAN-2002-0655 to issue 4.
In addition various potential buffer overflows not known to be exploitable have had assertions added to defend against them.
Who is affected?
----------------
Everyone using OpenSSL 0.9.6d or earlier, or 0.9.7-beta2 or earlier or current development snapshots of 0.9.7 to provide SSL or TLS is vulnerable, whether client or server. 0.9.6d servers on 32-bit systems with SSL 2.0 disabled are not vulnerable.
SSLeay is probably also affected.
Recommendations
---------------
Apply the attached patch to OpenSSL 0.9.6d, or upgrade to OpenSSL 0.9.6e. Recompile all applications using OpenSSL to provide SSL or TLS.
A patch for 0.9.7 is available from the OpenSSL website (http://www.openssl.org/).
Servers can disable SSL2, alternatively disable all applications using SSL or TLS until the patches are applied. Users of 0.9.7 pre-release versions with Kerberos enabled will also have to disable Kerberos.
Client should be disabled altogether until the patches are applied.
Known Exploits
--------------
There are no know exploits available for these vulnerabilities. As noted above, Neohapsis have demonstrated internally that an exploit is possible, but have not released the exploit code.
References
----------
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN
Acknowledgements
----------------
The project leading to this advisory is sponsored by the Defense Advanced Research Projects Agency (DARPA) and Air Force Research Laboratory, Air Force Materiel Command, USAF, under agreement number F30602-01-2-0537.
The patch and advisory were prepared by Ben Laurie.
Advisory 2
==========
Vulnerabilities
---------------
The ASN1 parser can be confused by supplying it with certain invalid encodings.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2002-0659 to this issue.
Who is affected?
----------------
Any OpenSSL program which uses the ASN1 library to parse untrusted data. This includes all SSL or TLS applications, those using S/MIME (PKCS#7) or certificate generation routines.
Recommendations
---------------
Apply the patch to OpenSSL, or upgrade to OpenSSL 0.9.6e. Recompile all applications using OpenSSL.
Users of 0.9.7 pre-release versions should apply the patch or upgrade to 0.9.7-beta3 or later. Recompile all applications using OpenSSL.
Exploits
--------
There are no known exploits for this vulnerability.
References
----------
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN
Acknowledgements
----------------
This vulnerability was discovered by Adi Stav and James Yonan independently. The patch is partly based on a version by Adi Stav.
The patch and advisory were prepared by Dr. Stephen Henson.
Combined patches for OpenSSL 0.9.6d:
http://www.openssl.org/news/patch_20020730_0_9_6d
Combined patches for OpenSSL 0.9.7 beta 2:
http://www.openssl.org/news/patch_20020730_0_9_7.
URL for this Security Advisory:
http://www.openssl.org/news/secadv_20020730.txt
http://incoming.debian.org/openssl_0.9.6c-2.woody. 0_i386.deb
Ahh, how I love debian
--
grep "xercist"
-- The_Messenger
(Banned for telling the truth.)
Damn, I am getting tired of updating.
First it's apache, then PHP. A good thing I have written down how I managed to compile apache with php and that GD V2 lib. That really was a bitch, and now it's time again to update the server.
I guess that I am just unlucky that it's the few services that I run that gets a lot of updates at time..
I'm just hoping that everyone will go to a new major version number and leave the old behind with only bug fixes so one could have a "older" system that has been tested to death.
Most mirrors are not up to date yet, except:
Don't you think it's unfair that slashdot doesn't make a local mirror, or at least a local copy of files like this one? For people that pay by the megabyte being slashdotted is not only annoying, but costs them money. On one hand it would be cool to get that much attention, but most of the articles are not posted by people related to a linked site. The poor admin that has to get up early in the morning to fight what looks like a DDOS, but is in fact the slashdot effect.
WURD!!
If you just have OpenSSL installed for OpenSSH's benefit, are you affected by the vulnerability?
To anyone considering using openssl in their project you should be aware that it violates the GPL.
Read the FAQ at openssl and it says that the GPL holders need to give a special exemption to allow there code to link to openssl.
Very few project do this and thus are in violation of the GPL and there project cant legally be distributed.
It has been discussed at lenght on the debian-legal mailing lists if you want technical details.
Openssl is subversive, basically you can do what you want with it with the exception of using it with a GPL'ed product.
Say no to Openssl, use GNUTLS
almost all mirrors are down, the ones who aren't down dont have the newest source...
l -0.9.6e.tar.gz ....
the only one who had is was ftp://ftp.psy.uq.edu.au/pub/Crypto/OpenSSL/openss
Gewd morning lady and geeks, you are now entering... TRoLL TEWSDAE (like a sundae but on a tuesdae). Be prepared for insults, porn, crapfloods, and of course Taco's favorite: hot fudge.
Troll had declined during the past few weeks, but a call to action has increased not only the frequency of trolling, but also the quality of said trolling. We have gone from spreading FUD to making fun of open sores fucktards who have been doing our job for us. goddamnit if you're gonna troll, troll. But don't fucking go spreading FUD like you mean it, because that just makes you look like Bill Gates and you wouldn't want to have anything to do with the worlds wealthiest man now would you? No, I suppose not, but for your own fucking good, please PLEASE associate yourself with a bar of soap and a good deoderant (I use Sure(tm) myself, so be Sure to be dry)...
What does this vulnerability mean to you? Well, if you use lunix like many other worthless wastes of carbon and oxygen do, you will have to patch your systems to make yourselves feel worthwhile, due to your lack of pigment, penile length, or a respectable vehicle. No, it isn;t cool to drive a 1988 Subaru wagon, no matter what C++ for dummies said.
Rather than patching this security hole, you may want to consider some of the following:
- Going outside. Nature is a wonderful thing and I promise it won't kill you. I cannot, however, promise that a rabid troll will not kill you with a baseball bat or a meat hook.
- Using Windows. Hey, you may THINK it's not a cool as lunix, but once you realize there is more to life than constantly reading bugtraq to protect your 200 Mhz lunix box from those people who want to hack you over your AOL connection, you might just get the urge to make a phone call TO A FEMALE MEMBER OF THE FEMALE SEX WHO IS FEMALE.
- Get a girlfriend. Girls who use lunix don't count, as they are barren whores who should be shot.
Most importantly:
G to the oatse
C to the izzex
fo shizzle my nizzle, jamie@ieatratshitthenieatsomemoneyshit.vg is a shit-eating cock handling fucktard.
Usual place.
Like anyone who needs to know isn't already aware of the issue long before it's posted here..
HTH
FOAD
I agree; while I realize that Slashdot also pays for bandwidth, they're far better equipped to handle the millions of visitors who would be looking for this information. I wouldn't expect you to host a copy of the openssl source, but you could at least mirror the notice that there's a vulnerability. Especially when the submitter's writeup is completely devoid of content relating to the problem, like Pseud0's was this time. Really, you are doing a disservice to the community.
Obviously if you link to nytimes.com or cnet.com they're equipped to handle millions of visitors, but openssl.org? I doubt it very much.
rooooar
And you mod down those who call you on it. Great job, geeks!
The parent was totally on-topic.
Slashdot is a joke.
Even if you compile it yourself; even if you spend months verifying the source code, you can still be compiling in some backdoor code. Check out http://www.acm.org/classics/sep95/. If your compiler binary is compromised, no amount of source code review is going to help. Your only hope is to hand assemble a compiler and use that to build your software.
"I'm not impatient. I just hate waiting." - My Dad
I have 18 firewalls to update (I sell these and support them, it's a nice way to suppliment my income). I'm not having much luck updating them though.
So far (on 5/7 firewalls), updating the ssl libraries caused ssh to kick out. This is very much unlike upgrading ssh, where the currently running sessions would stay active and you just kill off the 'parent' sshd process and restart sshd to upgrade.
Does anyone know why upgrading the shared lib is kicking out running sessions of ssh linked against it? Short of compiling sshd statically, is there any way around this? So far all the boxes are local but I have a few that are quite a distance and short of enabling telnet with a throwaway root account or statically compiling a temporary sshd, I'm screwed. :-)
I'm running OpenSSH 3.4p1 on:
Do I need to rebuild these binaries? When will the OpenSSL audit be complete?
From the bugtraq announcement:
Package : openssl
Problem type : multiple remote exploits
Debian-specific: no
CVE : CAN-2002-0655 CAN-2002-0656 CAN-2002-0657 CAN-2002-0659
The OpenSSL development team has announced that a security audit by A.L.
Digital Ltd and The Bunker, under the DARPA CHATS program, has revealed
remotely exploitable buffer overflow conditions in the OpenSSL code.
Additionaly, the ASN1 parser in OpenSSL has a potential DoS attack
independently discovered by Adi Stav and James Yonan.
CAN-2002-0655 references overflows in buffers used to hold ASCII
representations of integers on 64 bit platforms. CAN-2002-0656
references buffer overflows in the SSL2 server implementation (by
sending an invalid key to the server) and the SSL3 client implementation
(by sending a large session id to the client). The SSL2 issue was also
noticed by Neohapsis, who have privately demonstrated exploit code for
this issue. CAN-2002-0659 references the ASN1 parser DoS issue.
These vulnerabilities have been addressed for Debian 3.0 (woody) in
openssl094_0.9.4-6.woody.0, openssl095_0.9.5a-6.woody.0 and
openssl_0.9.6c-2.woody.0.
These vulnerabilities are also present in Debian 2.2 (potato), but no
fix is available at this moment.
We recommend you upgrade your OpenSSL as soon as possible. Note that you
should restart any daemons running SSL. (E.g., ssh or ssl-enabled
apache.)
Dude I thought you were making a +1 funny comment there for a second... until I read your other posts and journal and realised that you are without a doubt the gayest karma-whoring taco-snotter I have encountered on this fag-filled board.
Please cease your wanton waste of this planet's oxygen supply immediately. kthx.
P.S Micro$oft? Dude, go eat some cocks and stop posting here.
What's up, Doc?
Anyone who thinks they can secure thier box by getting a binary patch from this joker is inviting a nice backdoor/trojan.
Calmly proceed to nearest mirror, FreeBSD users, calmly wait for nectar to import it, other OS's wait for packages, or for itto be imported.
Rushing out in panic is not helping you.
FreeBSD The Power to Serve
All of us Windows users know that *nix is not secure.
zealot: "OpenSSL is an application. It is not part of the OS. The OS is secure."
OK, then. IIS is an application, too. So Windows is secure.
zealot: "IIS comes with the OS. So Windows is not secure."
So what? You do not have to install it with the OS.
zealot: "Windows (l)users don't know any better. They always install everything."
If those users switched to *nix, they would do the same.
zealot: "Don't confuse design security flaws with misconfiguration security vulnerabilities."
Same to you.
zealot: "My head hurts. Don't make me look at things without prejudice."
I don't know what kind of system you're trying it out on, but I just finished compiling and installing not only openssl 0.9.6e on my mandrake server (shut up), but I also recompiled and reinstalled openssh 3.4.p1 for good measure.
:P
I'm ssh'd through the server and back out to the slackware router right now, doing the same recompile/reinstall dance on it. Yes, I did kill the parent sshd process, ran the new binary, then logged off and back on.
In other words, it works for me!
is the fact, that warcraft 3 is out.
does this read anyone?
Patches also available in http://www.ademar.org/misc/openssl-patches for the ones who haven't access to bugtraq or openssl-{devel,users}.
Date: Tue, 30 Jul 2002 14:42:12 -0300
From: "Ademar de Souza Reis Jr." <ademar@conectiva.com.br>
Subject: Re: OpenSSL patches for other versions
To: Bugtraq <BUGTRAQ@SECURITYFOCUS.COM>
Cc: Ben Laurie <ben@algroup.co.uk>,
OpenSSL Announce <openssl-announce@openssl.org>,
OpenSSL Dev <openssl-dev@openssl.org>, openssl-users@openssl.org
X-Url: http://www.ademar.org/
[-- Attachment #1 --]
[-- Type: text/plain, Encoding: 7bit, Size: 1.0K --]
On Tue, Jul 30, 2002 at 11:15:00AM +0100, Ben Laurie wrote:
> Enclosed are patches for today's OpenSSL security alert which apply to
> other versions. The patch for 0.9.7 is supplied by Ben Laurie
> <ben@algroup.co.uk> and the remainder by Vincent Danen (email not
> supplied).
>
> Patches are for 0.9.5a, 0.9.6 (use 0.9.6b patch), 0.9.6b, 0.9.6c, 0.9.7-dev.
>
> These patches are known to apply correctly but have not been
> thoroughly tested.
Hello.
While checking the patches you sent I noticed that in the ones for
openssh < 0.9.7-dev, the ASN.1 fix is not present (several checks in
crypto/asn1/asn1_lib.c).
So I backported the fixes based on 0.9.7-dev and in a patch for 0.9.6d sent
by Ben Laurie to openssl-team@openssl.org on July27 (subject: Final
version?).
Patches for 0.9.5a, 0.9.6a and 0.9.6b including fix for ASN.1 vulns attached.
They're not well tested yet - after sucessful compilation.
Cheers.
- Ademar
with stuff uploaded. And i'm far too lazy to mess with the stuff. I primarily posted it there so I could find it when i get home!
To the guy who said that my running SSHd behind stunnel to protect from SSH bugs (such as the recent OpenSSH advisory) was not paranoid enough:
Time to wrap everything in IPSEC, then wait for a new hole in that?
I do not deploy Linux. Ever.
I've been wondering what this file is good for and what it does. You'll find it at crypto/asn1/t_pkey.c
Who needs these uncoditionally enabled (ie. no #if DEBUG) functions to print ones p,q prime factors and some more details about private keys; using some installable (ie. callback) BIO_printf functions? Who is installing these callback functions and when?
Thanks in advance,
ciao pm
openssl-0.9.6e (unlike d) goes through an almost endless sequence of refusing to install its man pages because it doesn't like the way the Perl 5.6.1 (also known as "stable") runs its Pod::Man module. Does anyone have a workaround that doesn't involve installing Perl 5.8.0 (not yet promoted to "stable" by the Perl folks)? Heck, does that even work, or are the openssl folks trying to force a downgrade of Perl? CPAN doesn't offer an obvious solution.
I don't really imagine we need the man pages, but putting a dependency like this in the openssl source is thoughtless - right when we're trying to have confidence in the crew there.
___
"with their freedom lost all virtue lose" - Milton
Replacing the install_docs part of the Makefile with the version from 0.9.6c fixes the problem. I'd quote it here but that violates /.'s "postercomment" compression filter. Anyway, it installs the docs just fine.
___
"with their freedom lost all virtue lose" - Milton
I only just compiled OpenSSL 0.9.6d on a RH6.2 box about 12 hours ago! Time to update and re-compile OpenSSH :(
"With Microsoft, you get Windows. With Linux, you get the full house" - unknown
Talking to a guy who writes security software based on OpenBSD (and works on OpenBSD in his spare time), that's why he preferred to use C (in very small programs, containing only the bits of code that absolutely had to run as root and using some form of interprocess communication to talk to the bells-and-whistles provision daemon) for security-critical daemons.
Any sufficiently advanced technology is indistinguishable from a rigged demo
--Andy Finkel (J. Klass?)
This really pisses me off since your username is close to mine. Your sig works out obviously to the string "cat /etc/passwd|mail Guest" which is then executed as a shell command, sending an insecure password file to some supposedly insecure mail account. (No I didn't execute it, and I run shadowed. Duh.)
I wonder if you are the same matts as on perlmonks.org. I am the same mattr. How annoying.
I'll thank you to remove that sig. Now, please. It's not funny to lay a pipe bomb and a box of matches on the curb; some people have a death wish and you are just helping them along.
That's the best troll I've ever seen. Can I copy it for future use? :D.
Heh, one word describes you my friend, and that word is "git"
1. My sig mails you your own passwd file. Were you even in 'first grade perl' you could figure that out. Maybe you can actually read Perlmonks instead of just being a groupie there. It makes a point that idiots like you shouldn't blindly exec perl one-lineers off slashdot sigs. See my profile for an actual nasty version and more info.
2. If your english skills are soo poor that you can't differentiate from "Mr_Perl" and "mattr" I really wonder how you managed those 3 paragraphs.
My poetry site welcomes the unusual.
B. It didn't require too much sweat to discover your lame-ass justification for your stupid (and criminal FWIW) sig. As it is there is little danger of anyone executing your sig, and all I have to do is wait a couple years or more until you get older and some similar stupidity blows up magnificently in your pinched egotistical face. Have a nice life (unlikely).