Re: [Full-Disclosure] Re: OpenSSL on Fire.

From: Michael Osten (mosten@bleepyou.com)
Date: 03/31/03

  • Next message: Gregory Le Bras | Security Corporation: "[Full-Disclosure] [SCSA-014] Remote Denial of Service Vulnerability in EZ Server" 
    From: Michael Osten <mosten@bleepyou.com>
To: martin f krafft <madduck@madduck.net>
Date: 30 Mar 2003 22:46:31 -0600

    On Sun, 2003-03-30 at 12:56, martin f krafft wrote:
    > also sprach harden@softhome.net <harden@softhome.net> [2003.03.30.0543 +0200]:
    > > As many of you already thought, suicide can be a way out of this
    > > uncomfortable position.
    >
    > [The rest snipped]
    >
    > I don't have time right now, but my curiosity is up. Has anyone
    > looked at what this OpenSSL Uzi shebang is all about?

    It is a wrapper for the "openssl-too-open" proof-of-concept that was
    released I believe in Jan 02. From just a quick glace it adds to the
    original by allowing scanning of class A's instead of just class C's.
    Performs web server and OS fingerprinting, and spits out a nice little
    victim list. The OpenSSL exploit was a remote non-root, but with the
    release of the ptrace exploit code it could get ugly for people that are
    *really* irresponsible about patching.

    -----------------
    Michael Osten
    www.bleepyou.com

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

  • Next message: Gregory Le Bras | Security Corporation: "[Full-Disclosure] [SCSA-014] Remote Denial of Service Vulnerability in EZ Server"