Date: Wed, 15 Oct 2014 08:12:22 +0200 From: Pierre Schweitzer <pierre@...ctos.org> To: oss-security@...ts.openwall.com Subject: Re: Truly scary SSL 3.0 vuln to be revealed soon: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, For "standard" IT people, this was kind of a good thing actually. Without knowing anything about the vulnerability itself, you were at least aware that something totally wrong was coming with SSLv3. So, it was letting a few hours to disable (for instance) SSLv3 on the infrastructure (or to check it had been properly done a while ago) before the issue comes out publicly with all the details and eventually PoC to exploit it. That's kind of great opportunity to make sure we're safe before it gets wrong. Just my 2 cents. On 10/15/2014 07:28 AM, Sona Sarmadi wrote: > Thanks Hanno, > > A reflection: Maybe we shouldn't post information like this here > or somewhere else which is not published yet even if the > information has leak out? Although all members here are reliable > but it is still an open mailing list and we should be careful and > act more responsible. > > Cheers Sona > >> It's out: >> >> https://www.openssl.org/~bodo/ssl-poodle.pdf >> http://googleonlinesecurity.blogspot.de/2014/10/this-poodle-bites- >> >> exploiting-ssl-30.html >> >> My conclusion stays the same: Disable SSLv3. >> >> -- Hanno Böck http://hboeck.de/ >> >> mail/jabber: hanno@...eck.de GPG: BBB51E42 - -- Pierre Schweitzer <pierre@...ctos.org> System & Network Administrator Senior Kernel Developer ReactOS Deutschland e.V. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJUPhBBAAoJEHVFVWw9WFsLG5AQAIRUEYp0f9Wt73J4YjhzPweB 9CEfmF6GN4Tp8GgH35dRCU2cQrh28CEuQPjFC/ay3CkcjBnmtc0n69BjwFP6m8bc sW9XzLifQQ85UiMA5Zyr1C94TAlso+c77xk0EVh7hu8B5iwXwYwRFD4+BKMumDXx nQOKJzq0EbSswDngZqP+54sO4pafytI8XfcGWhmIvC7oSwIxacY8O1UBrwVYWTca s4ukOpZB5eZtVzCjWaKojzd01/dsLYHXny6aUOzV4/+I/z77WymbCaUZxjGLg7Om ej26rAZeDRLjCu8uusK5ejJYvpMKs0E7c/xzCMHgzlXiZNHulVo213wD1NKdA4MY Rw7tA3jo1WqOw8/j9XRhtHpUGhGnYERtWV1+4rAPjJ6cZinz5ooinR6hNCbAXKz/ wxhgRhauxjgM2vCE2hd0T/PBjY6mP6IKYUquIsSYRan26XnbRp5Na184q9V92CPw EYgBdSfiuxmF1GT4a2U5OEWeWqEetQtIoLdp/7Ch4nZ7bhkNnGxnVGSEqLZRLd7s zgMyVgDC2L6NnwUd7YyVDE5DR6pgsflp/dnGvwScKfjtbtNV/jASNLKoO5BjOnn/ IOa1fsgdBL5NDw5RFOnSi2ifsY9/7+xCa7VUWKMT5W/XbsABRusgnyJxEKgM5n+B 3S85hEbRiamLnLCbV59A =4kV1 -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ