lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Sat, 7 Jun 2014 17:04:17 -0400
From: Craig Young <vuln-report@...ur3.us>
To: P Vixie <paul@...barn.org>
Cc: Full Disclosure <fulldisclosure@...lists.org>
Subject: Re: [FD] More OpenSSL issues

Yeah, definitely not in the same ballpark as heartbleed fortunately.

I have posted a detection script on the Tripwire blog to identify servers
permitting the early CCS:
http://www.tripwire.com/state-of-security/incident-detection/detection-script-for-cve-2014-0224-openssl-cipher-change-spec-injection/

It should detect potentially vulnerable hosts with a variety of
configurations.

Thanks,
Craig
On Jun 6, 2014 3:36 AM, "P Vixie" <paul@...barn.org> wrote:

> This does not appear to be the same panic level as the previous patch. In
> other words the previous openssl vuln was worse than the instability of
> all-night patching. This one is not. Take time to roll out right.
>
> On June 5, 2014 7:51:50 AM PDT, Jordan Urie <jordan@...ech.ca> wrote:
> >Ladies and Gentlemen,
> >
> >https://www.openssl.org/news/secadv_20140605.txt
> >
> >There's an MITM in there, and a potential for buffer over-runs.
> >
> >Patch up :-)
> >
> >
> >Jordan
> >
> >--
> >
> >Jordan R. Urie
> >
> >UP Technology Consulting, Inc.
> >1129 - 177A St. SW
> >Edmonton, AB  T6W 2A1
> >Phone: (780) 809-0932
> >
> >www.uptech.ca
> >
> >_______________________________________________
> >Sent through the Full Disclosure mailing list
> >http://nmap.org/mailman/listinfo/fulldisclosure
> >Web Archives & RSS: http://seclists.org/fulldisclosure/
>
> --
> Sent from my Android phone with K-9 Mail. Please excuse my brevity.
>
> _______________________________________________
> Sent through the Full Disclosure mailing list
> http://nmap.org/mailman/listinfo/fulldisclosure
> Web Archives & RSS: http://seclists.org/fulldisclosure/
>

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists