ignore security and it'll go away

Register | Login

FilesNewsUsersAuthors

Home Files News About Contact Add New

Showing 1 - 1 of 1

Files

Open Source CERT Security Advisory 2008.16

Posted Jan 7, 2009

Authored by Will Drewry, Open Source CERT | Site ocert.org

Several functions inside the OpenSSL library incorrectly check the result after calling the EVP_VerifyFinal function. This bug allows a malformed signature to be treated as a good signature rather than as an error. This issue affects the signature checks on DSA and ECDSA keys used with SSL/TLS. The flaw may be exploited by a malicious server or a man-in-the-middle attack that presents a malformed SSL/TLS signature from a certificate chain to a vulnerable client, bypassing validation.

tags | advisory

advisories | CVE-2008-5077, CVE-2008-0021, CVE-2008-0025

MD5 | be0e81721da50c8f104a4d26e99d8d02

Download | Favorite | Comments (0)