full-disclosure

Open Source and information security mailing list archives

Date: Sat, 7 Jun 2014 17:04:17 -0400
From: Craig Young <vuln-report@...ur3.us>
To: P Vixie <paul@...barn.org>
Cc: Full Disclosure <fulldisclosure@...lists.org>
Subject: Re: [FD] More OpenSSL issues

Yeah, definitely not in the same ballpark as heartbleed fortunately.

I have posted a detection script on the Tripwire blog to identify servers
permitting the early CCS:
http://www.tripwire.com/state-of-security/incident-detection/detection-script-for-cve-2014-0224-openssl-cipher-change-spec-injection/

It should detect potentially vulnerable hosts with a variety of
configurations.

Thanks,
Craig
On Jun 6, 2014 3:36 AM, "P Vixie" <paul@...barn.org> wrote:

> This does not appear to be the same panic level as the previous patch. In
> other words the previous openssl vuln was worse than the instability of
> all-night patching. This one is not. Take time to roll out right.
>
> On June 5, 2014 7:51:50 AM PDT, Jordan Urie <jordan@...ech.ca> wrote:
> >Ladies and Gentlemen,
> >
> >https://www.openssl.org/news/secadv_20140605.txt
> >
> >There's an MITM in there, and a potential for buffer over-runs.
> >
> >Patch up :-)
> >
> >
> >Jordan
> >
> >--
> >
> >Jordan R. Urie
> >
> >UP Technology Consulting, Inc.
> >1129 - 177A St. SW
> >Edmonton, AB  T6W 2A1
> >Phone: (780) 809-0932
> >
> >www.uptech.ca
> >
> >_______________________________________________
> >Sent through the Full Disclosure mailing list
> >http://nmap.org/mailman/listinfo/fulldisclosure
> >Web Archives & RSS: http://seclists.org/fulldisclosure/
>
> --
> Sent from my Android phone with K-9 Mail. Please excuse my brevity.
>
> _______________________________________________
> Sent through the Full Disclosure mailing list
> http://nmap.org/mailman/listinfo/fulldisclosure
> Web Archives & RSS: http://seclists.org/fulldisclosure/
>

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives