[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: Vulnerability in OpenSSL 1.0.x & Firefox 4 Silent Updates
- To: or-talk@xxxxxxxxxxxxx
- Subject: Re: Vulnerability in OpenSSL 1.0.x & Firefox 4 Silent Updates
- From: Nick Mathewson <nickm@xxxxxxxxxxxxx>
- Date: Fri, 13 Aug 2010 10:46:53 -0400
- Delivered-to: archiver@xxxxxxxx
- Delivered-to: or-talk-outgoing@xxxxxxxx
- Delivered-to: or-talk@xxxxxxxx
- Delivery-date: Fri, 13 Aug 2010 10:47:06 -0400
- Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:sender:received :in-reply-to:references:date:x-google-sender-auth:message-id:subject :from:to:content-type; bh=fdKn4qNsCGa8jgCp36g3EmEGBtSEnehAf48NUpeOBeE=; b=P2ONrq0J8u8AvePvA7wxTfCBz4g8pleb4h+AQ7Y7TOcQAptVRzPIL6CzXMsuGG3avU QBBM0tv05ta2hdPPkpPpzhco+IZsR8IqheAtLXFo+jOTU8CGYeyQQtmwQIxKj7N+upxl gzCp2OqxbvOoL0b2+3V1vTDlMPcvJVKrrMlas=
- Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:sender:in-reply-to:references:date :x-google-sender-auth:message-id:subject:from:to:content-type; b=r3X0LcylG3TyOTi8BWoR9EhA7q1Hn9P9U4KPP5kHPkuxhsK0kqlLqFjYXuevr7zXtC rvv2c3OFpdD1gXldbYttR/7+cmJdkWhCGeqKxsksbJ7on9j+mnVxjaUhu7BEDvD+K76z j4O5Yh5vIfhmvwpO4AjeeBczrIs9y9/474iSI=
- In-reply-to: <N1B-0mF0ymqp8U@xxxxxxxxxxxxx>
- References: <N1B-0mF0ymqp8U@xxxxxxxxxxxxx>
- Reply-to: or-talk@xxxxxxxxxxxxx
- Sender: owner-or-talk@xxxxxxxxxxxxx
On Wed, Aug 11, 2010 at 2:42 AM,
<whowatchesthewatcherswatches@xxxxxxxxxxxxx> wrote:
> Vulnerability in OpenSSL 1.0.x
> http://marc.info/?t=128118169100001&r=1&w=2
> http://archives.neohapsis.com/archives/fulldisclosure/2010-08/0085.html
>
> Tor server/client use vuln?
Looking at the claims, it seems to only affect OpenSSL 1.0.0a and
maybe 1.0.0. (I can reproduce it with 1.0.0.a, but not with 0.9.8x
and earlier.) None of our binary packages ship with any version of
OpenSSL 1.0.x (unless I'm missing something), so people using our
binaries are probably safe. I'll ask around harder later today to
make sure everything is in fact getting built in conformance with its
instructions.
If you're using a version of openssl 1.0.0a that comes with your
operating system, with any luck your vendor will already have issued a
patch. If not, there is an alleged patch posted in that thread at
http://marc.info/?l=openssl-dev&m=128128256314328&w=2 ; I haven't
evaluated it, and it doesn't seem to have gotten merged into openssl
proper yet, so you shouldn't apply it blindly. It looks safe to me,
but what do I know? Personally, I'd think re-linking your Tor against
a statically built 0.9.8o would probably be a better bet than
rebuilding your vendor openssl.
It's also possible (though not certain) that Tor could be unaffected.
If you look at the code in question, it only seems to gets invoked for
the elliptic-curve crypto case, which Tor doesn't use or enable.
OTOH, I haven't checked carefully enough to be sure there's no way to
force an openssl 1.0.0a server into that codepath if it doesn't have
any elliptic curve stuff configured, so caution is still warranted.
--
Nick
***********************************************************************
To unsubscribe, send an e-mail to majordomo@xxxxxxxxxxxxxx with
unsubscribe or-talk in the body. http://archives.seul.org/or/talk/