Re: [apache-ssl] Assertions considered bad!? (was: Re: [apache-ssl] Invalid method in request)

[Ben Laurie]

Ah, I also forgot to mention that an attacker with the ability to talk
to gcache can completely screw you with just legitimate messages - by
poisoning your cache. They can presumably also get access to session
keys. So, if anyone can talk to gcache apart from Apache-SSL, you've had
it anyway.

Cheers,

Ben.

-- 
Ben Laurie            |Phone: +44 (181) 735 0686| Apache Group member
Freelance Consultant  |Fax:   +44 (181) 735 0689|http://www.apache.org/
and Technical Director|Email: [EMAIL PROTECTED] |
A.L. Digital Ltd,     |Apache-SSL author     http://www.apache-ssl.org/
London, England.      |"Apache: TDG" http://www.ora.com/catalog/apache/
______________________________________________________________________
Apache Interface to SSLeay (mod_ssl)   www.engelschall.com/sw/mod_ssl/
Official Support Mailing List               [EMAIL PROTECTED]
Automated List Manager                       [EMAIL PROTECTED]