full-disclosure - [FD] Auditing systems for vulnerable 3rd-party OpenSSL

Open Source and information security mailing list archives

Message-Id: <1397584397.14239.106824685.0362A286@webmail.messagingengine.com>
Date: Tue, 15 Apr 2014 13:53:17 -0400
From: Gabriel Brezi <gb@...rau.lc>
To: fulldisclosure@...lists.org
Subject: [FD] Auditing systems for vulnerable 3rd-party OpenSSL

I'm advising a client on auditing his systems for vulnerable OpenSSL
libs which may be included by 3rd-parties. Does anyone know of some
relatively simple tools that I can leverage to figure out what
applications were bundled with out of date libs? Most of the focus will
be Linux and OSX systems.

I'll cover as much as I can by automating ldd, nm, JAR unpackers and
UPX. I'll have to contact developers directly if I find evidence of
obfuscation tools. Can someone add to this list of concerns or weigh in
on any existing tools that can automate part of this process?

I don't know OSX so well so extra advice for this platform is helpful.

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives