1. Home

Product groups

Support

New OpenSSL vulnerability - WeOnlyDo Discussion board

New OpenSSL vulnerability (wodSSH / wodSSH.NET)

by Mark, Thursday, May 05, 2016, 23:36 (3124 days ago) @ Jasmine

I believe the below vulnerability affects 1.0.2g.

Thanks,
Mark


CVE-2016-2107 (OpenSSL advisory) [High severity] 3rd May 2016:

A MITM attacker can use a padding oracle attack to decrypt traffic when the connection uses an AES CBC cipher and the server support AES-NI. This issue was introduced as part of the fix for Lucky 13 padding attack (CVE-2013-0169). The padding check was rewritten to be in constant time by making sure that always the same bytes are read and compared against either the MAC or padding bytes. But it no longer checked that there was enough data to have both the MAC and padding bytes. Reported by Juraj Somorovsky.
Fixed in OpenSSL 1.0.1t (Affected 1.0.1s, 1.0.1r, 1.0.1q, 1.0.1p, 1.0.1o, 1.0.1n, 1.0.1m, 1.0.1l, 1.0.1k, 1.0.1j, 1.0.1i, 1.0.1h, 1.0.1g, 1.0.1f, 1.0.1e, 1.0.1d, 1.0.1c, 1.0.1b, 1.0.1a, 1.0.1)
Fixed in OpenSSL 1.0.2h (Affected 1.0.2g, 1.0.2f, 1.0.2e, 1.0.2d, 1.0.2c, 1.0.2b, 1.0.2a, 1.0.2)

locked
4913 views

Complete thread:

 

Just thought you'd like to know that my gateway app with your SMTP Server component held the line against a DDOS attack today...

Chris Langsenkamp
Clever Technologies

Your support is fantastic.

Douglas Michael Panchyshyn
The Net Software Group

Just thought you'd like to know that my gateway app with your SMTP Server component held the line against a DDOS attack today...

Chris Langsenkamp
Clever Technologies

You made it so simple for us to integrate SFTP - a technology we had little experience with...

Zack Menendez
Mapframe Corporation

...not only that you provide these components at very reasonable cost, your responsiveness to emailed technical questions is simply outstanding...

Michael Thomas
ClownRed Media

...with the SFTP interface you produced, everything was so simple to understand, we were able to start coding almost immediately!

Zack Menendez
Mapframe Corporation

You did a great job on wodSSH and wodSSHServer! I got a lot for very little money. Thanks!

Dirk Bulinckx
bvba Woodstone

...I'm extremely impressed with the product, it represents excellent value for money...

Danny Haworth
Assetdisk

Thank you so much for your hard work and commitment in producing well thought-out solutions. WeOnlyDo is very committed to customer satisfaction!

Mike McPherson
Nokia Inc.

Many thanks for your excellent support service. I can see why you have a long list of excellent testimonials on your website.

Martyn Walker
Batmore Technolgies