Re: [Full-Disclosure] OpenSSL - dynamically linked binaries?

From: Bram Matthys (Syzop) (
Date: 03/22/04

  • Next message: Max Valdez: "Re: [Full-Disclosure] Re: pgp passphrase"
    To: Honza Vlach <>
    Date: Mon, 22 Mar 2004 17:06:38 +0100

    Honza Vlach wrote:
    > I have checked apache mod_ssl and php module, which are both dynamically
    > linked to the The thing, that confuses me lot is, when I
    > look on the phpinfo(), it says "OpenSSL version 0.9.7c", which it
    > was compiled against.
    > Does this mean, that I'm still vulnerable, or it is just version
    > hardcoded to the binary, while the library itself was sucessfully
    > reloaded?

    The latter...
    The thing is that OPENSSL_VERSION_TEXT is used to display the
    openssl version (AFAIK there's no alternative method):
         php_info_print_table_row(2, "OpenSSL Version", OPENSSL_VERSION_TEXT);

    OPENSSL_VERSION_TEXT is defined in one of the openssl header files
    (opensslv.h) and is a string constant, thus compiled in.

    So if ldd shows it's using that lib (you could even lsof it at runtime
    to be sure) then you should be ok.

            Bram Matthys.

    Full-Disclosure - We believe in it.

  • Next message: Max Valdez: "Re: [Full-Disclosure] Re: pgp passphrase"