haifisch / dayswithoutansslexploit Goto Github PK

https://openssl.org/news/secadv/20151203.txt

https://www.openssl.org/news/secadv_20141015.txt

Severity: High

A flaw in the DTLS SRTP extension parsing code allows an attacker, who
sends a carefully crafted handshake message, to cause OpenSSL to fail
to free up to 64k of memory causing a memory leak. This could be
exploited in a Denial Of Service attack. This issue affects OpenSSL
1.0.1 server implementations for both SSL/TLS and DTLS regardless of
whether SRTP is used or configured. Implementations of OpenSSL that
have been compiled with OPENSSL_NO_SRTP defined are not affected.

OpenSSL 1.0.1 users should upgrade to 1.0.1j.

This issue was reported to OpenSSL on 26th September 2014, based on an original
issue and patch developed by the LibreSSL project. Further analysis of the issue
was performed by the OpenSSL team.

The fix was developed by the OpenSSL team.

https://openssl.org/news/secadv/20160128.txt

Please use a standard date format, preference to yyyy-mm-dd from ISO 8601 (catalog)

Eg 2014-11-26

This way the dates are unambiguous internationally.

http://www.isup.me/dayswithoutansslexploit.com as of Sat June 18th

http://en.wikipedia.org/wiki/Bar_mitzvah_attack
http://thehackernews.com/2015/03/rc4-ssl-tls-security.html

Not sure if there's a CVE yet.

http://openssl.org/news/secadv_20150108.txt

Please, check http://www.gnutls.org/security.html.
Thanks.
Raul

https://www.openssl.org/news/secadv/20160301.txt
https://www.drownattack.com/#faq-cve
https://www.drownattack.com/#faq-details

http://openssl.org/news/secadv_20150709.txt

https://www.openssl.org/news/secadv/20160503.txt

http://askubuntu.com/questions/537196/how-do-i-patch-workaround-sslv3-poodle-vulnerability-cve-2014-3566

https://securityblog.redhat.com/2015/09/02/factoring-rsa-keys-with-tls-perfect-forward-secrecy/

http://www.certifiedsecure.com/polarssl-advisory/
https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2014-04

Negative days. Sounds scary. https://mta.openssl.org/pipermail/openssl-users/2015-March/000778.html