> > > > These patches are known to apply correctly but have not been > > thoroughly tested. > > As I understand it, OpenSSL will call abort() when it detects attack > against any hole in SSL. It might be acceptable for process-per-connection > situations like Apache, but when one process serves many connections it > produces nice DoS. Yes, it's better than exploitable hole but still not > acceptable. > > Arne
I agree. An exploit should return an error to the application and invalidate the connection attempt. It should not cause the application to terminate. There are other places in the code where checks for input lengths vs buffer lengths are performed. Never has OpenSSL called abort() in the past. Also, the exploit error should preferably be sent to a call back so that proper logging can be performed. Jeffrey Altman * Sr.Software Designer Kermit 95 2.0 GUI available now!!! The Kermit Project @ Columbia University SSH, Secure Telnet, Secure FTP, HTTP http://www.kermit-project.org/ Secured with MIT Kerberos, SRP, and [EMAIL PROTECTED] OpenSSL. ______________________________________________________________________ OpenSSL Project http://www.openssl.org Development Mailing List [EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
