Critical OpenSSL bug allows attackers to impersonate any trusted website
http://arstechnica.com/security/2015/07/critical-openssl-bug-allows-attackers-to-impersonate-any-trusted-website/
The bug allows attackers to force vulnerable end-user applications
into treating an invalid certificate as a legitimate transport
layer security (TLS) or secure sockets layer (SSL) credential. As
a result, adversaries with the ability to monitor a connection
between the end user and trusted server could intercept or even
modify data passing between them. The vulnerability resides in
OpenSSL versions 1.0.2c, 1.0.2b, 1.0.1n, and 1.0.10. The flaw
appears to have been added earlier this year, based on this Github
contribution dated January 27.
- - -
--Lauren--
Lauren Weinstein ([email protected]): http://www.vortex.com/lauren
Founder:
- Network Neutrality Squad: http://www.nnsquad.org
- PRIVACY Forum: http://www.vortex.com/privacy-info
Co-Founder: People For Internet Responsibility: http://www.pfir.org/pfir-info
Member: ACM Committee on Computers and Public Policy
Lauren's Blog: http://lauren.vortex.com
Google+: http://google.com/+LaurenWeinstein
Twitter: http://twitter.com/laurenweinstein
Tel: +1 (818) 225-2800 / Skype: vortex.com
_______________________________________________
pfir mailing list
http://lists.pfir.org/mailman/listinfo/pfir
