CVE-2013-4353 and CVSS v2 vector with Authentication set to None

2014-01-27 Thread Amarendra Godbole
Hi, I am analyzing CVE-2013-4353, and the CVSS vector mentions Au parameter to N [1] From what I understand, the culprit code is called in the Server Finish message of the handshake, which is the last step - by this time the client has authenticated the server (step 3). So why does the CVSS

Permanent error with binary OpenSSL installed

2014-01-27 Thread Norbert Kailan
Dear Open SSL community, thank you for this opportunity to use open SSL. I will donate adequate only when I can use it. I installed too newer versions of OpenSSL binaries distributed from http://slproweb.com/products/Win32OpenSSL.html. Great seems to be all OK. But I cannot use the command

Re: Permanent error with binary OpenSSL installed

2014-01-27 Thread Thomas J. Hruska
On 1/26/2014 12:39 PM, Norbert Kailan wrote: Whatever I want to do appears an error message and the command is not executed: “Unable to load config info from /usr/local/ssl/openssl.cnf “. There is no such file after installation! Reboot your computer. This is a known but rare issue that only

Linking errors while building openssl 1.0.1e with gcc-3.4.3 and glibc 2.2.5

2014-01-27 Thread Shalu Jain
Hi, When I build openssl source code with gcc 3.4.3 and glibc 2.2.5, I get undefined symbol errors. Some of those errors are as follows: (cryptlib.o)(.text+0x18a): In function `OPENSSL_showfatal': : undefined reference to `__vfprintf_chk' (obj_dat.o)(.text+0xf01): In function `OBJ_obj2txt': :