On Wed, 18 Sep 2002, Cristian Grigoriu wrote:
> From: "Laurentiu Matei" <[EMAIL PROTECTED]>
> > Iar ultima versiune de la Mandrake zice asa:
> > PATCHED: detects small overflow, but crashes (0.9.6e)
>
> Daca te uiti in sursa (openssl-sslv2-master.c) ia uite ce gasesti:
>
> "It is difficult to tell OpenSSL 0.9.6e from vulnerable versions
> because the OpenSSL developers chose to kill the process if a buffer
> overflow attempt is detected. Over the network, a crash due to a
> buffer overflow and an abrupt, but deliberate process termination look
> the same: in both cases, the TCP connection breaks down. At first
> glance, it appears that we are out of luck and cannot detect vulnerable
> versions.
>
> However, if we overrun the buffer by only a few bytes, the vulnerable
> version (without check) does NOT crash. This way, we can tell 0.9.6e
> from previous, vulnerable versions:
>
> large overflow small overflow
> pre-0.9.6e crash no crash
> 0.9.6e crash crash
> 0.9.6g error error
> "
> Intr-un cuvint, poti sa dormi linistit.
Eu am 0.9.6b pe mashina aia. RPM de la RH. Cand rulez tool-ul imi zice:
ip_mashina 443 VULNERABLE: does not detect small overflow
Repet, e vorba de openssl-ul din acel cel mai recent advisory de la RH
care se refera la OpenSSL.
Pe partea de server apare in errors_log (cand am rulat tool-ul):
[Wed Sep 18 14:04:05 2002] [notice] child pid 4105 exit signal
Segmentation fault (11)
Radu
--
Radu Filip
Network Administrator @ Technical University of Iasi
[EMAIL PROTECTED] Information Technology and Communication Center
http://socrate.tuiasi.ro/ [EMAIL PROTECTED] | http://ccti.tuiasi.ro/
---
Pentru dezabonare, trimiteti mail la
[EMAIL PROTECTED] cu subiectul 'unsubscribe rlug'.
REGULI, arhive si alte informatii: http://www.lug.ro/mlist/
