lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <2EF00BC33B6F48E192C9C97B79CECB10@localhost> Date: Mon, 6 May 2013 15:30:42 +0200 From: "Stefan Kanthak" <stefan.kanthak@...go.de> To: <bugtraq@...urityfocus.com> Cc: <full-disclosure@...ts.grok.org.uk> Subject: VULNERABLE and COMPLETELY outdated 3rd-party libraries/components used in 3CX Phone 6 Hi @ll, the current 3CXPhone6.msi (for Windows), available from <http://www.3cx.com/VOIP/sip-phone/>, digitally signed on 2012-07-30, installs the following outdated and vulnerable 3rd-party libraries: * libeay32.dll and ssleay32.dll version 0.9.8h (from 2008-05-28) of OpenSSL. The current version of OpenSSL is 0.9.8y, see <http://www.openssl.org/>, it fixes about 20 CVEs found in earlier versions downto 0.9.8h. * FFmpeg/FFdshow version 1.1.0 The current version of FFmpeg/FFdshow is 1.2, see <http://www.ffmpeg.org/security.html> for the 24 fixed CVEs since 1.1.0. Timeline: ~~~~~~~~~ 2013-05-03 vendor informed 2013-05-05 vendor replied: "3CX Phone is freeware, use another software" I second that: don't use software from 3CX! 2013-05-06 report published Stefan Kanthak
Powered by blists - more mailing lists