full-disclosure - OpenSSL Vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: dimitry at al.org.ua (Dmitry Alyabyev)
Subject: OpenSSL Vulnerabilities

On Friday 02 August 2002 09:33, Peter Bieringer wrote:
> > Here's how I do it [line may wrap]:
> >
> > for i in /bin/* /usr/bin/* /sbin/* /usr/sbin/* /usr/X11R6/bin/*
> > /usr/local/bin/* ; do if ldd $i | egrep 'libssl' > /dev/null ; then
> > echo $i ; fi ; done
> >
> > You could change the list of directories you want to search, or use
> > the output of a find in the for command.  I don't think libcrypto
> > has issues; if it does, make the argument to egrep
> > 'libcrypto|libssl'.
>
> And
>
> # lsof  | egrep 'libcrypto|libssl'
>
> or shorter
>
> # lsof  | egrep 'libcrypto|libssl' | awk '{ print$1 }' | sort | uniq
>
> gives an overview, which current running processes must be restarted
> afer updating the libraries (and calling ldconfig).

IMHO the general problem is recompiling progs which use OpenSSL statically

-- 
Dimitry