full-disclosure - Re: OpenSSL on Fire.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1049086011.2577.6.camel@laptop.bleepyou.com>
From: mosten at bleepyou.com (Michael Osten)
Subject: Re: OpenSSL on Fire.

On Sun, 2003-03-30 at 12:56, martin f krafft wrote:
> also sprach harden@...thome.net <harden@...thome.net> [2003.03.30.0543 +0200]:
> > As many of you already thought, suicide can be a way out of this 
> > uncomfortable position.
> 
> [The rest snipped]
> 
> I don't have time right now, but my curiosity is up. Has anyone
> looked at what this OpenSSL Uzi shebang is all about?

It is a wrapper for the "openssl-too-open" proof-of-concept that was
released I believe in Jan 02.  From just a quick glace it adds to the
original by allowing scanning of class A's instead of just class C's. 
Performs web server and OS fingerprinting, and spits out a nice little
victim list.  The OpenSSL exploit was a remote non-root, but with the
release of the ptrace exploit code it could get ugly for people that are
*really* irresponsible about patching.

-----------------
Michael Osten
www.bleepyou.com