Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

Re: Re: OpenSSL on Fire.
From: Michael Osten <mosten () bleepyou com>
Date: 30 Mar 2003 22:46:31 -0600

On Sun, 2003-03-30 at 12:56, martin f krafft wrote:
also sprach harden () softhome net <harden () softhome net> [2003.03.30.0543 +0200]:
As many of you already thought, suicide can be a way out of this 
uncomfortable position.

[The rest snipped]

I don't have time right now, but my curiosity is up. Has anyone
looked at what this OpenSSL Uzi shebang is all about?

It is a wrapper for the "openssl-too-open" proof-of-concept that was
released I believe in Jan 02.  From just a quick glace it adds to the
original by allowing scanning of class A's instead of just class C's. 
Performs web server and OS fingerprinting, and spits out a nice little
victim list.  The OpenSSL exploit was a remote non-root, but with the
release of the ptrace exploit code it could get ugly for people that are
*really* irresponsible about patching.

-----------------
Michael Osten
www.bleepyou.com


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]