Re: OpenSSL bufffer overflow
- From: Stefan Esser <se@xxxxxxxxxxx>
- Date: Thu, 04 Oct 2007 15:39:08 +0200
Mike Tancsa schrieb:
At 05:43 PM 9/28/2007, Stefan Esser wrote:
I did not see any commits to the OpenSSL code, recently; is anybody
going to commit the fix?
See http://www.securityfocus.com/archive/1/480855/30/0 for details ...
How serious is this particular issue ? Is it easily exploitable, or
difficult to do ? Are some apps more at risk of exploitation than
others ? e.g. ssh,apache ?
Seems that the following URL (from the FreeBSD Security Advisory)
has a better formatted version of the same information as can be
found at the location I had given:
http://marc.info/?l=bugtraq&m=119091888624735
A trailing '\0' can be written on the position following a buffer,
with little effort. The BugTraq entry describes it in detail ...
But (AFAIK) no further analysis has been performed.
Regards, STefan
_______________________________________________
freebsd-security@xxxxxxxxxxx mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscribe@xxxxxxxxxxx"
- References:
- Re: OpenSSL bufffer overflow
- From: Mike Tancsa
- Re: OpenSSL bufffer overflow
- Prev by Date: Re: FreeBSD Security Advisory FreeBSD-SA-07:08.openssl
- Next by Date: Test
- Previous by thread: Re: OpenSSL bufffer overflow
- Next by thread: Re: OpenSSL bufffer overflow
- Index(es):
Relevant Pages
|
|
