OpenSSL Security Vulnerability

already patched by Anonymous Coward · 2003-09-30 10:49 · Score: 2, Informative

thanks up2date :-)

Re:already patched by zumajim · 2003-09-30 10:57 · Score: 2, Informative

Thanks apt! And no subscription fee either.
Re:already patched by Michalson · 2003-09-30 11:54 · Score: 2, Interesting

Perhaps they announce the bugs just after Microsoft does in hopes that the OSS community will still be bashing the "M$ is teh suc" drum loud enough that they won't notice yet another exploit (BTW, has buggy Outlook been able to beat Mozilla's "run arbitary code just by *connecting* to a POP mail server" exploit yet?)
Re:already patched by ichimunki · 2003-10-01 03:17 · Score: 2, Informative

but IMHO the way you knock the 800 pound gorilla out of the tree (MS) is with at least a 400 pound gorilla.

And here I thought the best way was a well aimed projectile.

If Microsoft is an 800 pound gorilla, then Red Hat is a fruit fly. MSFT has a market cap of 301 billion dollars. RHAT has a market cap of 1.75 million dollars. MSFT is 172,000 times larger than RHAT in this sense. Or maybe we should compare annual sales revenues (MSFT = 354 * RHAT). Or number of employees (MSFT = 99 * RHAT). Even on this last most favorable measure, RHAT is a ring-tailed lemur compared to the Microsoft gorilla. BTW, most gorillas weigh under 400 pounds. :)

(none of this should be construed as criticism of or dislike for RHAT, I'm a huge fan and shareholder-- I cannot say the same about MSFT)

--
I do not have a signature

phew by Anonymous Coward · 2003-09-30 10:49 · Score: 5, Funny

thank goodness i use windows

Re:phew by Troll_Kamikaze · 2003-09-30 11:00 · Score: 5, Funny

Hell, Microsoft is even kind enough to send the "Latest Internet Patch" right to my inbox. Sometimes 36 times a day, when necessary!!

Now that's what I call service!
Re:phew by DickBreath · 2003-09-30 12:32 · Score: 2, Interesting

Guess you would be really screwed if you used openssl on windows eh?

If you were, would you even know it?

If an open source program falls in a binary only forrest, does it make a sound?

--

I'll see your senator, and I'll raise you two judges.
Re:phew by BlackBolt · 2003-10-01 00:52 · Score: 2, Insightful

Yeah, me too. Ignorance is bliss.

I like to just sit back, have an espresso, and let everything around me fall into chaos. Life is good; the flashing warning lights keep me company through the long night.

Which means.... by Anonymous Coward · 2003-09-30 10:51 · Score: 2, Funny

we should patch in about a week from now when
the second round of patches come out.

pheeew by Dreadlord · 2003-09-30 10:53 · Score: 3, Funny

fortunately I'm running something secure like telnet, those OpenSSH bugs never scare me...

--
The IT section color scheme sucks.

Feeling kinda good about it by ThenAgain · 2003-09-30 10:53 · Score: 3, Informative

At least we find out when where vulnerable BEFORE the exploits start rolling out. I'm also yet to hear of Linux bringing the net to it's knees when some kid writes an e-mail virus.

Also, it took me less than a minute to patch my webserver. That's good design.

Re:Feeling kinda good about it by Overly+Critical+Guy · 2003-09-30 10:57 · Score: 4, Insightful

At least we find out when where vulnerable BEFORE the exploits start rolling out.

As opposed to what? The months before Blaster came out that the patch was available?

Things like this just illustrate that all software has bugs. OSS is not a magic solution, and Microsoft does not hire poor programmers. That won't stop rampant anti-"M$" trolls of course, but the more rational of us can look at this and move on.

--
"Sufferin' succotash."
Re:Feeling kinda good about it by Penguinshit · 2003-09-30 11:24 · Score: 2, Informative

As opposed to what? The months before Blaster came out that the patch was available?

Actually, it was a couple of weeks. And that was very much the exception to the rule with regards to Microsoft's history with bug reporting/patching.

Case in point is the IE mishandling of SSL which allowed anyone with a valid cert to issue a "valid" cert for any OTHER domain. This went on, denied and downplayed by Microsoft, for HOW long?

--
I have something in common with Stephen Hawking...
Re:Feeling kinda good about it by ebay+troll · 2003-09-30 11:45 · Score: 5, Funny

excellent poster!!!!!!! responded in less than 5 minutes, pleasure to work with, quick response

A+++++++++++!
Re:Feeling kinda good about it by wfberg · 2003-09-30 13:39 · Score: 4, Insightful

At least we find out when where vulnerable BEFORE the exploits start rolling out.

As opposed to what? The months before Blaster came out that the patch was available?

To be fair; that patch didn't install on a significant portion of machines (any system running w2k sp2), and the work-around Microsoft suggested didn't either, and if it did, it didn't until a reboot, which wasn't mentioned.
Add to that that the first patch appeared to install but did not (and would also not "re"install) on a number of machines. Today microsoft advises you to run a firewall and anti-virus programs all over their webpage. Before the blaster incident they didn't, because they hadn't dropped the ball quite as badly yet.

I also find it (not so..) amusing that the System File Checker doesn't work without the DCOM service running (which isn't running for example, in Safe Mode, a Mode you'd expect sfc to be used in), and that DCOM for some reason listens to any one who will talk to it, rather than, by default, restrict access to 127/8.

--
SCO employee? Check out the bounty

Re:Got the popcorn by Skyshadow · 2003-09-30 10:54 · Score: 4, Insightful

Looks like there were "a number" of vulnerabilities. Perhaps they should have waited?

Waited for what, perfection?

In a Real World environment, "pretty safe" is a whole hell of a lot better than nothing. So long as flaws are fixed quickly after being identified, I don't see what the problem is.

If you want *real* security, you need an air gap. Otherwise, quit yer bitchin'.

--
Every year during my review, I just pray the words "slashdot.org" aren't mentioned.

Why is some software more secure than others? by cras · 2003-09-30 10:59 · Score: 5, Insightful

I got annoyed at the slashdot comments last time there was security hole in OpenSSH and wrote this page (copy pasted below). I count OpenSSL as insecure software - we need a secure replacement. GNUTLS looks somewhat better, but I don't trust it too much either.

Why is some software more secure than others?

How do you measure software security?

Here's my definition on what is secure software.

Intro

I get really tired of seeing these kinds of comments every time some widely used software has security holes:

No software is secure. The difference is how quickly they fix it.
It's good that they were found. Now we have less security holes.
Popular software gets more security audits which is why they seem to have more security holes.

While they may be partially true, I think they're also very misleading and disparages the hard work that some secure software authors have done.

Simplicity Is Security

The difference between secure and insecure software is really the coding techniques being used by it's authors. Authors of secure software do everything they can to prevent accidental mistakes from ever happening. Authors of insecure software just fixes the accidental mistakes. There are very few secure software authors.

Auditing insecure software doesn't make it secure. Sendmail is a good example of this. It's been audited countless times by competent people. The simplest mistakes were catched easily long time ago, but a few very difficult to find vulnerabilities were found only recently.

How do secure software authors then avoid the kind of security holes that are difficult to find? By keeping the code simple. The code doesn't get secure by polluting it with tons of security checks. It gets secure by keeping the security checks in as few places as possible.

Auditing secure software is easy. You can just quickly browse through most of the sources without having to stop and look at it carefully. Everything just looks clean, simple and correct. vsftpd is a good example of this.

Sure, it's still possible that secure software has some security holes occationally. It just happens a lot less often (if ever) and usually the problems are less critical. For example none of the security holes in Postfix have lead to arbitrary code execution or being able to read other peoples mails. Denial of Service attacks are nothing compared to them.

(some examples in the web page not included)

Re:Why is some software more secure than others? by Anonymous Coward · 2003-09-30 11:06 · Score: 3, Informative

What the hell are you rambling on about? OpenSSL is not inherently insecure. While your points about using the KISS method are good practice for any software, in some cases complexity is inherent to the app. OpenSSL implements cryptographic protocol which is *not* simple, both because of the underlying mathematics, and because of the care which must be taken to avoid attacks which trivialize it.

And if you think auditing "secure software" is easy, you're just setting yourself up to be owned. Auditing should be done meticulously no matter how simple the app is perceived to be.
Re:Why is some software more secure than others? by GSloop · 2003-09-30 11:10 · Score: 3, Insightful

'No software is secure. The difference is how quickly they fix it."

Perhaps no software is absolutly secure, and without bugs, but we're not anywhere close yet.

Software needs to be designed (engineered is a better word) to be secure, modular and ONLY as functional as needed.

I think in general, OSS and Linux do this better than Windows does, but it's a methodology change every OS level software writer needs to take to heart.

It's critical when Office crashes, or had bugs, but not as critical as in SSL, Apache or something similar.

In short, I think the laissez faire attitude we all have, both from accepting bugs, and about coding them ourselves is a SIGNIFICANT part of the problem. We need to raise the expectations, and hold people/companies accountable when these standards are not met.

Cheers,
Greg
Re:Why is some software more secure than others? by SiliconEntity · 2003-09-30 11:21 · Score: 5, Informative

How do secure software authors then avoid the kind of security holes that are difficult to find? By keeping the code simple.

You're way off base in this case. SSL requires the use of X.509 certificates, and it was in the cert parsing code that these new vulnerabilities were found. X.509 means ASN.1 formats, which have at least two different encoding rules, BER and DER that both must be supported; implicit versus explicit tags; several different ways of encoding packet lengths, and a host of other complexities. There's no way to write this kind of code and just keep it simple as you describe. Any implementation of SSL which is going to interoperate with other systems on the net is going to face these complexities.

I've written certificate handling code so I know how complicated it is. Also worth reading is Peter Gutmann's somewhat dated but still insightful X.509 Style Guide which describes some of the horrors an X.509 implementation has to deal with.

In this case the failures were mostly in the error handling, and any developer knows that this tends to be the hardest part of your program to get right. Not only are there a lot more ways things can fail than go right, but they can fail in many more places in your code and it is very difficult to make sure your program can recover gracefully from everywhere something might go wrong.

Also, I'm not sure if it's public yet, but a lot of other implementations are affected by this besides OpenSSL. See the CERT advisory when it comes out and you will find some of the biggest names in the security business got burned by this. It's absurd to suppose that your cosmic insights are somehow being overlooked by companies that base their reputations on security.
Re:Why is some software more secure than others? by cras · 2003-09-30 11:39 · Score: 2, Interesting

I think I'll have to change the wording some more. Complex things require complex code, that's fine. If there's a security hole because the behaviour was wrong in some case, it's understandable.

What I especially don't like is that the same old buffer overflow and other memory allocation related problems come up over and over again. The 1. problem in this case was a double-free() bug. Although this is the most difficult C-related problem to solve easily (without garbage collector), with cleaner code it likely wouldn't have gone there in the first place. If you can easily see where the memory is allocated and deallocated, it's hard to screw up.
Re:Why is some software more secure than others? by iabervon · 2003-09-30 12:27 · Score: 4, Insightful

X.509 may be extremely complex to handle, but that would lead to incorrect X.509 implementations. This, however, was just unsafe code. There's nothing about X.509's complexity which should lead to stack corruption.

The errors which you should expect from a X.509 implementation involve failing to parse obscure certificates correctly or failing to give the right error message about a malformed X.509 certificate. If the code itself is simple in implementation, it should be straightforwardly obvious that, no matter what, the parser will return either an X.509 structure or an error message; the complexity of X.509 merely prevents anyone from determining if the return value is actually correct.

OpenSSL has a lot of spagetti code, wrappers, and unnecessary function pointers, inherited from the SSLeay days. In an ideal world, it would be rewritten to be more straightforward, but that's more effort than anyone is really willing to put in (except the GNUTLS people, but that's license-related anyway).
Re:Why is some software more secure than others? by njchick · 2003-09-30 13:21 · Score: 2, Interesting

In this case the failures were mostly in the error handling, and any developer knows that this tends to be the hardest part of your program to get right. Not only are there a lot more ways things can fail than go right, but they can fail in many more places in your code and it is very difficult to make sure your program can recover gracefully from everywhere something might go wrong.
I always wanted to have better support for error handling in C. Programmers should not be forced to handle errors by nested if's, "goto error" and wrapper functions that do nothing but check the result of another function and do cleanup. But please don't offer me C++ or Java. If OpenSSL is written in C, that's for a reason. Compatibility with all other libraries, relative independence from the compiler, native speed - those reasons cannot be ignored. If C is good to write secure software in it, I want exception handling in C.
Re:Why is some software more secure than others? by pebs · 2003-09-30 13:34 · Score: 5, Insightful

In short, I think the laissez faire attitude we all have, both from accepting bugs, and about coding them ourselves is a SIGNIFICANT part of the problem. We need to raise the expectations, and hold people/companies accountable when these standards are not met.

Here lies the problem:

1) Cheap
2) Fast
3) Secure

Pick 2

--
#!/
Re:Why is some software more secure than others? by cras · 2003-09-30 13:35 · Score: 3, Informative

I always wanted to have better support for error handling in C. Programmers should not be forced to handle errors by nested if's, "goto error" and wrapper functions that do nothing but check the result of another function and do cleanup.

Exceptions would be nice, but I think in most cases the cleanup is just freeing dynamically allocated memory. Solution is to get rid of the free() calls. Garbage collector, memory pools, alloca(), data stack, etc. Data stack and memory pools have worked very well with my latest project. Error handling is almost always just a return call and there's hardly any wrapper functions just for handling errors. Too bad I haven't yet had time to test how well they'd work in other kind of software. I'd guess pretty well except maybe for general purpose libraries since they require a bit different way of writing C code.
Re:Why is some software more secure than others? by dmiller · 2003-09-30 13:45 · Score: 2, Informative

OpenSSH isn't vulnerable to this problem. We don't use OpenSSL's ASN.1 routines for network-supplied data.
Re:Why is some software more secure than others? by Hard_Code · 2003-09-30 15:24 · Score: 2, Interesting

What about Cyclone?

It seems like a good step forward.

--

It's 10 PM. Do you know if you're un-American?

Re:Minor Bug by Anonymous Coward · 2003-09-30 10:59 · Score: 3, Informative

from the advisory:
4. Due to an error in the SSL/TLS protocol handling, a server will parse a client certificate when one is not specifically requested. This by itself is not strictly speaking a vulnerability but it does mean that *all* SSL/TLS servers that use OpenSSL can be attacked using vulnerabilities 1, 2 and 3 even if they don't enable client authentication.

so i do think that it affects most users.

Re:first post! by soliaus · 2003-09-30 10:59 · Score: 3, Funny

first post!
posted via lynx over openssh! w00t! w00t!

Oh, so that was your box...sorry about that.

--
Speaking at Defcon 12 - Credit Card Networks Revisted: Pen

Re:dang! by GSloop · 2003-09-30 11:18 · Score: 4, Interesting

I'm getting really sick of hearing...

"Just run Windows Update. It's easy!"
"Just run apt-get It's easy!"

I'd like to quit running updates every 15 seconds or so.

I'd prefer it was right the first time. I'm getting really tired of patching machines all over the place. I'm turning into a patch money. Test, patch, test, patch, test, patch - with an occasional sleep and eat thrown in occasionally.

No matter how easy Windows update is, it still has to get done. If MS does it for you, you'll worry about them breaking stuff. If you have to do it yourself, you worry you'll miss something, or break it yourself. Frankly, that sucks.

Cheers,
Greg

Re:Lazy admin and Auto-Update by Fnord · 2003-09-30 11:20 · Score: 2, Informative

Most distributions do. With redhat you can subscribe to the redhat network, and with debian, its package manager, apt-get has this built in. Both of these however are dependant on the distro maintainers actually putting the new version in, and resolving dependancy issues that might arise.

On the other hand, unlike windows update you don't need to reboot every time you update something like this (the only time you ever need to boot is if you update the kernel).

Redhat 6.2 updates? by whoever57 · 2003-09-30 11:22 · Score: 2, Interesting

Anyone got any suggestions where I can find updated rpms for a RH6.2 machine?

Other than compiling from source, that is. Or upgrading to a supported distro! I'm hoping to put off that day!

--
The real "Libtards" are the Libertarians!

RedHat RPMS by pollock · 2003-09-30 11:23 · Score: 3, Informative

New RPMs and RedHat's security advisory for for 7.1, 7.2, 7.3 and 8.0 can be found here.

Re:Lazy admin and Auto-Update by m_chan · 2003-09-30 11:29 · Score: 2, Informative

> will we see another lazy-admin problem with this (and any) vulnerability in Open Source applications?

Lazy applies to admins, open-source applications, closed-source applications, make-up applications, partners in relationships, oil changes, bill-paying, laundry, dishes, dogs, eyeballs, and any other situation where not taking action is available as an option, which happens to be most situations. No fix for anything is any good if it goes unused.

> what good is an immediate bugfix if the admin isn't applying the patch?

That's rhetorical, I'm guessing.

> does Linux have a similar auto-update feature like in Windows

There are several, but most are not really like Windows. They are usually better. For example, if you run Debian or can use apt for rpm, run apt-get update && apt-get upgrade as a nightly cron job. But the admin still has to initially submit the job, and pick up the pieces when something breaks. Automagic patching can have side effects and certainly perpetuates the "someone else" problem. Besides, I like to watch the progress meter. Makes me feel useful.

Anyway, hire a new admin if the one you have can't be a verb as well as a noun.

one of life's little ironies by Bernie · 2003-09-30 11:34 · Score: 3, Funny

If you call your product "open" SSL (or openssh for that matter), and occasionally people will discover it's Exactly What It Says On The Tin.

Well it amused me anyway :)

Re:Lazy admin and Auto-Update by BigRedFish · 2003-09-30 11:47 · Score: 2, Informative

pardon my ignorance, does Linux have a similar auto-update feature like in Windows (but with fewer bugs :) ?

No problem, after all no one's born knowing this stuff. :)

It seems most Linux distros have such a feature under various names, but they generally call home (or the nearest mirror site, or wherever you told it to look), and compare the list of updates there against the software installed on your machine. Then it gives you the opportunity to review the relevant updates individually, with explanations about what they fix, on a per-application basis before installing any or all of them as you like. Many distros have a nice GUI app for this.

There are generally no monolothic do-all updates like in Windows-land; you only D/L what you need and if you ever install another package later off CD, you only have to grab the latest update for that one package, the system stays up, no reboots required. Or just install from the web and have the latest to begin with.

I can only speak for Mandrake about bugs, but I've never seen a fatal one on my home box. It doesn't try to think for you much to begin with, it just tells you what your options are and awaits your input, so there's less room for error, more ability to back-out, etc. There have been a couple of instances where it's gotten dependencies wrong, some boolean flag reversed so patch A required that I install patch B, then B required that I NOT install A. This only happened once and it was corrected a few hours later. Aside from that it's been fine.

Hope that helps. Oh, yeah I forgot this is slashdot: RTFM. ;)

Re:Lazy admin and Auto-Update by Elwood+P+Dowd · 2003-09-30 12:08 · Score: 2, Interesting

Also important is ease of updates for those of us that are semi-diligent.

For example, the two latest RPC patches (blaster and successor) have been mildly annoying to install. Sure, you just run MS's update tool, but I've found that about 20% of machines still read unpatched according to MS's security auditing tool. This makes it kindof a pain to ensure compliance.

After reapplying the patch six or seven times to some machines, our network is safe. That's kindof lame.

Similarly, the patch that would have prevented SQL Slammer was a collossal pain in the ass to install. Fortunately, we don't have any laptop users with SQL Server, so there was no potential infection vector on our network, and we had plenty of time to patch.

Deploying all the different Office VB patches is looking prohibitively difficult to me. It hasn't been exploited yet by a worm, but when it does... shit. I hope our AV is up to the task.

I guess MS Software Update Server is an absolute necessity. No two ways about it. Weird how it doesn't get more discussion.

Almost always, apt-get upgrade is cake. I'm just concerned about those times it breaks. Hopefully it can always be repaired manually. I've definitely run into snags with apt-get that were beyong my ability to repair. It was on a toy machine, so it might have had an unusual configuration, and it wasn't consequential.

Whether we're diligent or not, if patches are difficult enough it barely matters that the patch was released at all, in terms of worldwide impact.

--

There are no trails. There are no trees out here.

Re:Got the popcorn by Anonymous Coward · 2003-09-30 12:24 · Score: 2, Interesting

Let's get the Microsoft flamefest started!

Flamebait? More like the truth. Take a look at the rest of the posts in this story, especially the ones modded to 4 and 5. Microsoft flames, all.

Re:Open Source Code Quality by statusbar · 2003-09-30 12:39 · Score: 3, Insightful

The man page is lying. Make a test program. It is entirely possible for two or more programs to allocate more memory than phys+swap together. malloc() and realloc() on linux NEVER return 0, unless one single allocation in one program exceeds swap.

Linux allocates physical memory pages on the fly, as you use them. Try this code. It allocates 256 megs on each run until you exit. How many times do you have to run it before it says malloc returns 0? How much more memory than you have (including swap) did it allocate?

#include <stdio.h> #include <unistd.h> int main() { char *p = (char *)malloc(256*1024*1024); printf( "malloc returned 0x%X\n", (unsigned long)p ); getchar(); }

This kind of thing happens with stacks as well. Memory on your stack is allocated on the fly as you use it. What happens when the kernel can't allocate a memory page when it is first accessed? It kills the process. hard. This means that user processes can steal resources and cause any number of root processes to die, just because they made a function call that required a larger stack.

This does have many security and dependability implications, as the original poster said. Most people do not know this and do not handle this case!

--jeff++

--
ipv6 is my vpn

Re:Lazy admin and Auto-Update by Pharmboy · 2003-09-30 13:23 · Score: 2, Informative

Here is the dirt:

RedHat RHN service:
$60 a year gets you two "entitlements" and they are $60 each afterward. You can change your entitlements to any computer as often as you want. I use one entitlement for just updating fresh installs, for instance. You can easily run a cron job by placing a script in /etc/cron.daily that simply says:

up2date -p
up2date -u

The -p updates their servers with all the supported packages you have installed(not necessary if you don't install anything or haven't since the last -p) and -u will update automatically. It is super easy and super cheap. There is one other big advantage.

You can NOT run a cron job and do updates from any computer using just a web browser. You log onto rhn.redhat.com then look at your computers. You can install new software, uninstall software, update systems, schedule reboots and more. I have remotely installed more than a few dozen kernel upgrades AND rebooted, with never one failure. I don't recommend remote booting ANY production box unless you like to live dangerously, however. I do tend to live dangerously.

It is highly cool, I have never seen it fail in almost 2 years, and very easy to do. You can opt for email notification if any box *needs* an update for security reasons, or not.

You can also ssh or telnet in and just run "up2date -u" and watch all the pretty # marks go by and update your computer. The download speeds are very good. In addition, you get premium access to download ISOs.

There are ways to keep a linux box updated for free, but the features that come with rhn make it a bargain for many of us. If you are not an uber-geek, or you are but have better things to do, it is a killer service. If you are a total noob, you can still understand and gain alot from it. If you are an OS snob, you will trash it because it is not as L33+ as rolling your own.

If you have to ask, then its a great service for you since it is easy to learn and unreal stable.

--
Tequila: It's not just for breakfast anymore!

Obligatory Gentoo Zealotry by MarcQuadra · 2003-09-30 13:50 · Score: 2

I have cron.daily (the *nix 'task scheduler') do an 'emerge -u world' on one machine, I also have a script in cron.hourly that searches the config directories for changed or new files and reminds me by echoing them from .login file.

Basically every time I log in in the morning I get a message like:

# Current files on iceage.doughtyhouse.net that need a looksie:
#
# /etc/._cfg0000_fstab
# /etc/conf.d/._cfg0000_hdparm

It's not windowsupdate, but it gets the job done even when I'm on vacation, and I've never had trouble with config files that get TOO out-of-date to still work.

--
"Sometimes, I think Trent just needs a cup of hot chocolate and a blankie." -Tori Amos on Nine Inch Nails

OpenSSH not vulnerable by dmiller · 2003-09-30 13:51 · Score: 4, Informative

OpenSSH isn't remotely vulnerable to these attacks. Recent versions don't use the OpenSSL ASN.1 parsing code for signature validation (e.g. signatures coming from the network). The OpenSSL ASN.1 code is only used for parsing private keys.

This was done a little while ago, as Markus (wisely) decided that we didn't need a whole ASN.1 parser just to verify signatures.

Don't let that slow you down patching the issue - Apache and other SSL/TLS apps (OpenLDAP, the various imapd's, etc.) may be vulnerable.

the ole keep it simple stupid... by vt0asta · 2003-09-30 14:32 · Score: 4, Insightful

...troll. Work smarter not harder. Nyuck, nyuck, nyuck. Well, thank god your here to tell everyone how to code secure simple software.

Be advised that complex data dependent protocols are not trivial to code. Not only that, they are even harder to get to interoperate with other implementations of the same protocol. All the nasty little bug-a-boos show up that the protocol designers hadn't thought or even dreamed of.

I count OpenSSL as insecure software - we need a secure replacement.

So what's the plan? Toss out all the OpenSSL/GNUtls code and start over...but this time let's try something new... let's make it simple and secure?

What you don't seem to understand, is that people far smarter than you and I have already had these philosophical debates and do you know what they came up with?

No software is completely secure.

Prompt disclosure is important.

More eyes, code review, what have you is a good thing.

Plan for failure/breaches/etc.

Your measure of secure software is juvenile. It doesn't even provide an interesting definition of software security. Pointing at less than complete implementations of smtp and ftp makes your entire argument suspect. Also the "auditing secure software is easy" comment is another dead give away.

--
No.

Understand the scope of the vulnerability by Anonymous Coward · 2003-09-30 14:49 · Score: 3, Informative

For a server that is using OpenSSL

Vulnerable to denial of service attack

Potentially vulnerable to remote exploits (unknown currently)

For a client (e.g. mail client) using OpenSSL

No vulnerability; the problems are on the server side, when processing client certificates

Its good to see.... by 222 · 2003-09-30 17:48 · Score: 2, Interesting

that the software we take for granted every day is being given such stiff auditing. I mean, sure it sucks to patch so often, but honestly, wouldnt you rather read this and patch before some jackass releases a public exploit, and every 15 year old that cant find something better to do decides to take down a production box?

Slashdot Mirror

OpenSSL Security Vulnerability

45 of 245 comments (clear)