Firewall Wizards mailing list archives
Re: RSAREF bug issues (was Re: Looking for "lease based popper access")
From: "R. DuFresne" <dufresne () sysinfo com>
Date: Wed, 15 Dec 1999 19:10:45 -0600 (CST)
On Wed, 15 Dec 1999, Bennett Todd wrote:
1999-12-13-12:50:43 R. DuFresne:Has there been a patch released by the RSA folks to deal with it's recent failing? The impact of the RSA buffer overflow is that it affects all applications built around it's core, this includes ssh, ssl enabled webservers, etc.. Yep all those aplications built with RSA are now exploitable, so, has a pacht been released that addresses this and allows folks to patch RSAREF then rebuild all the applications that use it?I think this note deserves a few comments. First off, yes, there has been a patch posted, the OpenBSD folks at least have released a patch, and maybe other folks have too I don't know, and the RSADSI folks have officially given permission to use this patch. RSADSI didn't release a patch themselves; they aren't programmers, they're just lawyers doing their day job of trying to prevent people from using good encryption. Second, the bug in question only affects the RSAREF code if it can be invoked in a hostile fashion; sufficient parm checking in the caller can protect this bug against a remote exploit. So independantly the OpenSSH folks had fixed their sshd so that this bug didn't end up producing an exploit for them.
Additionally clarifying what I think I now understand here: Means this is at least partially dependant upon the under<over?>lying application. The ssh1 exploit is a two in one punch, though broken code... Thanks, Ron DuFresne -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ admin & senior consultant: darkstar.sysinfo.com http://darkstar.sysinfo.com "Cutting the space budget really restores my faith in humanity. It eliminates dreams, goals, and ideals and lets us get straight to the business of hate, debauchery, and self-annihilation." -- Johnny Hart testing, only testing, and damn good at it too!
Current thread:
- Re: Looking for "lease based popper access" Rodney van den Oever (Dec 13)
- Re: Looking for "lease based popper access" sedwards (Dec 13)
- RE: Looking for "lease based popper access" Dom De Vitto (Dec 17)
- <Possible follow-ups>
- RE: Looking for "lease based popper access" Jan van Rensburg (Dec 13)
- RE: Looking for "lease based popper access" R. DuFresne (Dec 14)
- RSAREF Patch Leonard Miyata (Dec 15)
- RSAREF bug issues (was Re: Looking for "lease based popper access") Bennett Todd (Dec 15)
- Re: RSAREF bug issues (was Re: Looking for "lease based popper access") R. DuFresne (Dec 17)
- RE: Looking for "lease based popper access" R. DuFresne (Dec 14)
- Re: Looking for "lease based popper access" sedwards (Dec 13)
- RE: Looking for "lease based popper access" Jan van Rensburg (Dec 15)
- Re: Looking for "lease based popper access" Steven M. Bellovin (Dec 15)