[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <543E1046.5010508@reactos.org>
Date: Wed, 15 Oct 2014 08:12:22 +0200
From: Pierre Schweitzer <pierre@...ctos.org>
To: oss-security@...ts.openwall.com
Subject: Re: Truly scary SSL 3.0 vuln to be revealed soon:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hi,
For "standard" IT people, this was kind of a good thing actually.
Without knowing anything about the vulnerability itself, you were at
least aware that something totally wrong was coming with SSLv3. So, it
was letting a few hours to disable (for instance) SSLv3 on the
infrastructure (or to check it had been properly done a while ago)
before the issue comes out publicly with all the details and
eventually PoC to exploit it.
That's kind of great opportunity to make sure we're safe before it
gets wrong.
Just my 2 cents.
On 10/15/2014 07:28 AM, Sona Sarmadi wrote:
> Thanks Hanno,
>
> A reflection: Maybe we shouldn't post information like this here
> or somewhere else which is not published yet even if the
> information has leak out? Although all members here are reliable
> but it is still an open mailing list and we should be careful and
> act more responsible.
>
> Cheers Sona
>
>> It's out:
>>
>> https://www.openssl.org/~bodo/ssl-poodle.pdf
>> http://googleonlinesecurity.blogspot.de/2014/10/this-poodle-bites-
>>
>>
exploiting-ssl-30.html
>>
>> My conclusion stays the same: Disable SSLv3.
>>
>> -- Hanno Böck http://hboeck.de/
>>
>> mail/jabber: hanno@...eck.de GPG: BBB51E42
- --
Pierre Schweitzer <pierre@...ctos.org>
System & Network Administrator
Senior Kernel Developer
ReactOS Deutschland e.V.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAEBAgAGBQJUPhBBAAoJEHVFVWw9WFsLG5AQAIRUEYp0f9Wt73J4YjhzPweB
9CEfmF6GN4Tp8GgH35dRCU2cQrh28CEuQPjFC/ay3CkcjBnmtc0n69BjwFP6m8bc
sW9XzLifQQ85UiMA5Zyr1C94TAlso+c77xk0EVh7hu8B5iwXwYwRFD4+BKMumDXx
nQOKJzq0EbSswDngZqP+54sO4pafytI8XfcGWhmIvC7oSwIxacY8O1UBrwVYWTca
s4ukOpZB5eZtVzCjWaKojzd01/dsLYHXny6aUOzV4/+I/z77WymbCaUZxjGLg7Om
ej26rAZeDRLjCu8uusK5ejJYvpMKs0E7c/xzCMHgzlXiZNHulVo213wD1NKdA4MY
Rw7tA3jo1WqOw8/j9XRhtHpUGhGnYERtWV1+4rAPjJ6cZinz5ooinR6hNCbAXKz/
wxhgRhauxjgM2vCE2hd0T/PBjY6mP6IKYUquIsSYRan26XnbRp5Na184q9V92CPw
EYgBdSfiuxmF1GT4a2U5OEWeWqEetQtIoLdp/7Ch4nZ7bhkNnGxnVGSEqLZRLd7s
zgMyVgDC2L6NnwUd7YyVDE5DR6pgsflp/dnGvwScKfjtbtNV/jASNLKoO5BjOnn/
IOa1fsgdBL5NDw5RFOnSi2ifsY9/7+xCa7VUWKMT5W/XbsABRusgnyJxEKgM5n+B
3S85hEbRiamLnLCbV59A
=4kV1
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
