Date: Wed, 09 Apr 2014 09:50:25 -0500 From: Karl Denninger <karl@denninger.net> To: Steven Hartland <killing@multiplay.co.uk>, freebsd-security@freebsd.org Subject: Re: FreeBSD Security Advisory FreeBSD-SA-14:06.openssl Message-ID: <53455E31.90100@denninger.net> In-Reply-To: <8A7E8A9A8B034A3498601347FFFF088C@multiplay.co.uk> References: <mailman.384.1397005594.1401.freebsd-security@freebsd.org> <20140409142136.GA871@faust.sbb.rs> <53455877.5020006@denninger.net> <8A7E8A9A8B034A3498601347FFFF088C@multiplay.co.uk>
index | next in thread | previous in thread | raw e-mail
[-- Attachment #1 --] On 4/9/2014 9:47 AM, Steven Hartland wrote: > ----- Original Message ----- From: "Karl Denninger" <karl@denninger.net> > > > > On 4/9/2014 9:21 AM, Zoran Kolic wrote: >>> Advisory claims 10.0 only to be affected. Patches to >>> branch 9 are not of importance on the same level? >>> >>> >> 9 (and before) were only impacted if you loaded the newer OpenSSL >> from ports. A fair number of people did, however, as a means of >> preventing BEAST attack vectors. >> >> If you did, then you need to update that and have all your private >> keys re-issued. If you did not then you never had the buggy code in >> the first place. > > Actually they are vulnerable without any ports install just not to > CVE-2014-0160 only CVE-2014-0076, both of which where fixed by > SA-14:06.openssl > > Regards > Steve Good point -- there is that other advisory in there so "base" 8.x and 9.x users should update as well. However, the other problem does not involve the same sort of vulnerability to remote "grabs" of data, including authentication credentials (and worse, private key data.) -- -- Karl karl@denninger.net [-- Attachment #2 --] 0 *H 01 0 + 0 *H O0K030 *H 01 0 UUS10UFlorida10U Niceville10U Cuda Systems LLC1 0UCuda Systems LLC CA1/0- *H customer-service@cudasystems.net0 130824190344Z 180823190344Z0[1 0 UUS10UFlorida10UKarl Denninger1!0 *H karl@denninger.net0"0 *H 0 bi՞] MNԿawx?`)'ҴcWgR@BlWh+ u}ApdCF JVй~FOL }EW^bچYp3K& ׂ(R lxڝ.xz?6 &nsJ +1v9 v/( kqĪp[vjcK%fϻe?iq]z lyzFO'ppdX//Lw(3 JI A*S#՟H[f|CGqJKoo y.oEuOw$ /섀$삻J9b|A P~8]D1YI<"""Y^T2iQ2 b yH)] Ƶ0y$ _N 6XqMC 9 XgώjGTP"#nˋ"Bk1 00 U 0 0 `HB0 U 0, `HB OpenSSL Generated Certificate0 U |8 ˴d[20 U #0]Af4 U3x&^"408 `HB+)https://cudasystems.net:11443/revoked.crl0 *H gBwH] j\x`( &gW32"Uf^. ^Iϱ k!DQA g{(w /)\N'[ oRW @C HO>)XrTNɘ!u`xt5(=f\-l3<@C6mnhv##1ŃbH͍_Nq aʷ?rk$^9TIa!kh,D -ct1 0001 0 UUS10UFlorida10U Niceville10U Cuda Systems LLC1 0UCuda Systems LLC CA1/0- *H customer-service@cudasystems.net0 + ;0 *H 1 *H 0 *H 1 140409145025Z0# *H 1ыPdyR%Ӽz 0l *H 1_0]0 `He*0 `He0 *H 0*H 0 *H @0+0 *H (0 +71001 0 UUS10UFlorida10U Niceville10U Cuda Systems LLC1 0UCuda Systems LLC CA1/0- *H customer-service@cudasystems.net0 *H 101 0 UUS10UFlorida10U Niceville10U Cuda Systems LLC1 0UCuda Systems LLC CA1/0- *H customer-service@cudasystems.net0 *H HH< &EJ 9(:S3 Dڔ<>"1eZHWEQ%ϢU_fOv HR$Za-rmӱɋ } a$K^[8+s h`gbj\܉[$ċßpXC<t HhCt]i-AndU{ʵm$V#NhwA-g ;SMvxʖQ<6h|g { M+cQxC~&Vh:[NP"Wi6A%Ey/Mʞ LD l yb|\;< {~XC&>4= aY92t$cZJWa2Y6)DgqZ-(ʨBCh='o8Tnԕ o ھDf7_VSd(1Ø kzBͻQ/RH^˒home | help
Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?53455E31.90100>