[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-bugs] #4822 [Tor Client]: Avoid vulnerability CVE-2011-4576 : Disable SSL3?
#4822: Avoid vulnerability CVE-2011-4576 : Disable SSL3?
------------------------+---------------------------------------------------
Reporter: nickm | Owner:
Type: defect | Status: needs_review
Priority: critical | Milestone: Tor: 0.2.1.x-final
Component: Tor Client | Version:
Keywords: | Parent:
Points: | Actualpoints:
------------------------+---------------------------------------------------
Comment(by rransom):
Replying to [comment:14 nickm]:
> Replying to [comment:11 rransom]:
> > Replying to [comment:9 nickm]:
> > > Okay, please look at branch bug4822_021_v2 in my public repository.
It takes the SSL_OP_NO_SSLv3 approach.
> > I still think we should use a runtime version check, not a compile-
time version check -- people ''will'' build Tor against an old OpenSSL
shared library and run it with a new one.
>
> Hm. That case is actually safe; the problem would be if they built with
a newer one and ran with an older one. Does that seem likely? And
shouldn't a decent library system prevent this?
The dangerous case could happen with packages for one Linux distribution
used on a different distribution (e.g. packages built on and for Ubuntu
used on Mint, before Mint updates its OpenSSL packages). But if there is
no reason to try to enable SSL 3 whenever it is safe to do so, we
shouldn't make this change depend on OpenSSL's version at all.
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/4822#comment:15>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs