full-disclosure - Re: [FD] heartbleed OpenSSL bug CVE-2014-0160

Open Source and information security mailing list archives

Message-ID: <20140410230654.GC5361@debjann.fritz.box>
Date: Fri, 11 Apr 2014 01:06:54 +0200
From: Jann Horn <jann@...jh.net>
To: fulldisclosure@...lists.org
Subject: Re: [FD] heartbleed OpenSSL bug CVE-2014-0160

On Wed, Apr 09, 2014 at 09:59:59PM -0400, Peter Malone wrote:
> Unless I'm mistaken, the following memcmp is vulnerable to a remote
> timing attack.
> https://github.com/openssl/openssl/blob/master/ssl/ssl_lib.c#L1974
> static int ssl_session_cmp(const SSL_SESSION *a,const SSL_SESSION *b)  
> {  
>   if (a->ssl_version != b->ssl_version)  
>        return(1);  
>   if (a->session_id_length != b->session_id_length)  
>        return(1);  
>   return(memcmp(a->session_id,b->session_id,a->session_id_length));  
> }

Not used anywhere though, just a corpse lying around in the code. 

Download attachment "signature.asc" of type "application/pgp-signature" (837 bytes)

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives