From owner-freebsd-security  Wed Jul 31  4:55:33 2002
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.FreeBSD.org (mx1.FreeBSD.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id BD1AB37B400
	for <security@freebsd.org>; Wed, 31 Jul 2002 04:55:30 -0700 (PDT)
Received: from cage.simianscience.com (cage.simianscience.com [64.7.134.1])
	by mx1.FreeBSD.org (Postfix) with ESMTP id AE6A643E6A
	for <security@freebsd.org>; Wed, 31 Jul 2002 04:55:29 -0700 (PDT)
	(envelope-from mike@sentex.net)
Received: from house.sentex.net (fcage [192.168.0.2])
	by cage.simianscience.com (8.12.5/8.12.3) with ESMTP id g6VBtQ1A015956;
	Wed, 31 Jul 2002 07:55:27 -0400 (EDT)
	(envelope-from mike@sentex.net)
Message-Id: <5.1.0.14.0.20020731075521.04b14d70@192.168.0.12>
X-Sender: mdtancsa@192.168.0.12
X-Mailer: QUALCOMM Windows Eudora Version 5.1
Date: Wed, 31 Jul 2002 07:57:30 -0400
To: Sune Stjerneby <sst@vmunix.dk>
From: Mike Tancsa <mike@sentex.net>
Subject: Re: apache mod_ssl ?
Cc: security@freebsd.org
In-Reply-To: <20020731085657.GA33775@fnyx.vmunix.dk>
References: <5.1.0.14.0.20020730231635.040ee248@192.168.0.12>
 <5.1.0.14.0.20020730231635.040ee248@192.168.0.12>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"; format=flowed
X-Virus-Scanned: amavis-20020220
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org


Thanks, looks like my local copy libphp4.so as well :-(  Anyone know of any 
other apps statically compiled with bits of the vulnerable openssl out of 
the ports that would be affected ?

         ---Mike

At 10:56 AM 7/31/2002 +0200, Sune Stjerneby wrote:
>Mike Tancsa writes:
> >After a buildworld, do I need to worry about apache with mod_ssl ? Are
> >there parts that are statically compiled using openSSL ?
>
>I suspect so,
>
>% strings /usr/local/libexec/apache/libssl.so | egrep "0\.9\.6"
>OpenSSL 0.9.6a 5 Apr 2001
>
>After a rebuild, it reads "OpenSSL 0.9.6e 30 Jul 2002" in
>apache/libssl.so.
>
>--
>Sune Stjerneby <sst@vmunix.dk>
>  % bloto flem rech rech kini

--------------------------------------------------------------------
Mike Tancsa,                          	          tel +1 519 651 3400
Sentex Communications,     			  mike@sentex.net
Providing Internet since 1994                    www.sentex.net
Cambridge, Ontario Canada			  www.sentex.net/mike


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message