- 21 Nov, 2006 2 commits
-
-
Dr. Stephen Henson authored
-
Dr. Stephen Henson authored
Improve mkerr.pl header file function name parsing.
-
- 13 Nov, 2006 1 commit
-
-
Dr. Stephen Henson authored
-
- 27 Oct, 2006 1 commit
-
-
Nils Larsch authored
-
- 19 Oct, 2006 1 commit
-
-
Andy Polyakov authored
-
- 05 Oct, 2006 1 commit
-
-
Dr. Stephen Henson authored
-
- 04 Oct, 2006 1 commit
-
-
Nils Larsch authored
-
- 29 Sep, 2006 2 commits
-
-
Mark J. Cox authored
Steve Kiernan
-
Richard Levitte authored
-
- 28 Sep, 2006 6 commits
-
-
Bodo Möller authored
-
Bodo Möller authored
-
Richard Levitte authored
1) Certificate Message with no certs OpenSSL implementation sends the Certificate message during SSL handshake, however as per the specification, these have been omitted. -- RFC 2712 -- CertificateRequest, and the ServerKeyExchange shown in Figure 1 will be omitted since authentication and the establishment of a master secret will be done using the client's Kerberos credentials for the TLS server. The client's certificate will be omitted for the same reason. -- RFC 2712 -- 3) Pre-master secret Protocol version The pre-master secret generated by OpenSSL does not have the correct client version. RFC 2712 says, if the Kerberos option is selected, the pre-master secret structure is the same as that used in the RSA case. TLS specification defines pre-master secret as: struct { ProtocolVersion client_version; opaque random[46]; } PreMasterSecret; where client_version is the latest protocol version supported by the client The pre-master secret generated by OpenSSL does not have the correct client version. The implementation does not update the first 2 bytes of random secret for Kerberos Cipher suites. At the server-end, the client version from the pre-master secret is not validated. PR: 1336
-
Mark J. Cox authored
-
Mark J. Cox authored
-
Mark J. Cox authored
cause a denial of service. (CVE-2006-2940) [Steve Henson, Bodo Moeller] Fix ASN.1 parsing of certain invalid structures that can result in a denial of service. (CVE-2006-2937) [Steve Henson] Fix buffer overflow in SSL_get_shared_ciphers() function. (CVE-2006-3738) [Tavis Ormandy and Will Drewry, Google Security Team] Fix SSL client code which could crash if connecting to a malicious SSLv2 server. (CVE-2006-4343) [Tavis Ormandy and Will Drewry, Google Security Team]
-
- 23 Sep, 2006 1 commit
-
-
Dr. Stephen Henson authored
-
- 22 Sep, 2006 3 commits
-
-
Dr. Stephen Henson authored
-
Dr. Stephen Henson authored
-
Dr. Stephen Henson authored
PR: 1377
-
- 18 Sep, 2006 3 commits
-
-
Andy Polyakov authored
PR: 1390
-
Andy Polyakov authored
PR: 1382
-
Bodo Möller authored
[Problem pointed out by Adam Young <adamy (at) acm.org>]
-
- 12 Sep, 2006 1 commit
-
-
Bodo Möller authored
-
- 11 Sep, 2006 1 commit
-
-
Bodo Möller authored
ciphersuite as well
-
- 06 Sep, 2006 1 commit
-
-
Bodo Möller authored
Colin Percival (this would have caused more problems than solved, and isn't really necessary anyway)
-
- 05 Sep, 2006 3 commits
-
-
Mark J. Cox authored
-
Mark J. Cox authored
-
Mark J. Cox authored
(CVE-2006-4339) Submitted by: Ben Laurie, Google Security Team Reviewed by: bmoeller, mjc, shenson
-
- 31 Aug, 2006 2 commits
-
-
Dr. Stephen Henson authored
-
Dr. Stephen Henson authored
-
- 28 Aug, 2006 1 commit
-
-
Ben Laurie authored
-
- 01 Aug, 2006 1 commit
-
-
Andy Polyakov authored
-
- 31 Jul, 2006 1 commit
-
-
Bodo Möller authored
-
- 19 Jul, 2006 2 commits
-
-
Bodo Möller authored
Submitted by: NTT
-
Bodo Möller authored
-
- 13 Jul, 2006 1 commit
-
-
Dr. Stephen Henson authored
-
- 09 Jul, 2006 2 commits
-
-
Dr. Stephen Henson authored
-
Dr. Stephen Henson authored
-
- 02 Jul, 2006 1 commit
-
-
Ben Laurie authored
-
- 30 Jun, 2006 1 commit
-
-
Bodo Möller authored
-