oss-security - Re: Two OpenSSL DTLS remote DoS

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / news community lists wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [thread-next>] [month] [year] [list]

Date: Mon, 18 May 2009 19:50:54 +0100 (BST)
From: Mark J Cox <mjc@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: Two OpenSSL DTLS remote DoS

Stephen Henson pointed out that there is one other DTLS issue that 
probably has security consequences too, and that backporting DTLS issues 
is probably not the right thing to do given the amount of change happening 
in the DTLS code to fix protocol errors etc:

CVE-2009-1379 DTLS fragment read after free DoS
http://rt.openssl.org/Ticket/Display.html?id=1923&user=guest&pass=guest

Mark

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.