From owner-freebsd-security@FreeBSD.ORG Wed Apr 9 14:47:40 2014 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id C155A29C for ; Wed, 9 Apr 2014 14:47:40 +0000 (UTC) Received: from smtp1.multiplay.co.uk (smtp1.multiplay.co.uk [85.236.96.35]) by mx1.freebsd.org (Postfix) with ESMTP id 848281135 for ; Wed, 9 Apr 2014 14:47:40 +0000 (UTC) Received: by smtp1.multiplay.co.uk (Postfix, from userid 65534) id 0BB5D20E7088B; Wed, 9 Apr 2014 14:47:33 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on smtp1.multiplay.co.uk X-Spam-Level: * X-Spam-Status: No, score=2.0 required=8.0 tests=AWL,BAYES_00,DOS_OE_TO_MX, FSL_HELO_NON_FQDN_1,HELO_NO_DOMAIN,RDNS_DYNAMIC autolearn=no version=3.3.1 Received: from r2d2 (82-69-141-170.dsl.in-addr.zen.co.uk [82.69.141.170]) by smtp1.multiplay.co.uk (Postfix) with ESMTPS id 6EC8B20E70885; Wed, 9 Apr 2014 14:47:28 +0000 (UTC) Message-ID: <8A7E8A9A8B034A3498601347FFFF088C@multiplay.co.uk> From: "Steven Hartland" To: "Karl Denninger" , References: <20140409142136.GA871@faust.sbb.rs> <53455877.5020006@denninger.net> Subject: Re: FreeBSD Security Advisory FreeBSD-SA-14:06.openssl Date: Wed, 9 Apr 2014 15:47:25 +0100 MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset="Windows-1252"; reply-type=response Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.5931 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.6157 X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 Apr 2014 14:47:40 -0000 ----- Original Message ----- From: "Karl Denninger" On 4/9/2014 9:21 AM, Zoran Kolic wrote: >> Advisory claims 10.0 only to be affected. Patches to >> branch 9 are not of importance on the same level? >> >> > 9 (and before) were only impacted if you loaded the newer OpenSSL from > ports. A fair number of people did, however, as a means of preventing > BEAST attack vectors. > > If you did, then you need to update that and have all your private keys > re-issued. If you did not then you never had the buggy code in the > first place. Actually they are vulnerable without any ports install just not to CVE-2014-0160 only CVE-2014-0076, both of which where fixed by SA-14:06.openssl Regards Steve