Home page logo
/

oss-sec logo oss-sec mailing list archives

Re: CVE request: openssl timing attack
From: Tomas Hoger <thoger () redhat com>
Date: Mon, 4 Jul 2011 09:24:23 +0200

On Mon, 4 Jul 2011 02:52:41 +0400 Solar Designer wrote:

Question to OpenSSL developers: is the patch given in Billy Bob
Brumley and Nicola Tuveri's paper "Remote Timing Attacks Are Still
Practical" OK to be used by distros?  Basically, I am interested in
its "review status" by upstream - reviewed and approved, reviewed but
not approved for specific reasons, not sufficiently reviewed.  (The
patch is tiny, but even tiny changes might have non-obvious
implications.)

I'm not part of the group you directed this question too, but as I've
not seen any upstream developer or list in CC...

The fix from the paper was committed in openssl CVS within about a week
from public disclosure:

http://cvs.openssl.org/chngview?cn=20892

However, there were some concerns raised regarding the extra #ifdef
wrapping added as part of the commit, which disable the fix by default,
and the name suggests #ifndef was probably intended:

http://www.mail-archive.com/openssl-dev () openssl org/msg29283.html

HTH

-- 
Tomas Hoger / Red Hat Security Response Team


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]