OpenSSL bug, is stunnel also compromised?

[Jack Ryan]

Does anyone know?

[Zax]

On Wed, 9 Apr 2014 01:51:54 -0500 (CDT), Jack Ryan wrote in

Post by Jack Ryan
Does anyone know?

The openssl heartbleed bug is server-side and enables an attacker to
read memory that potentially contains the secret key associated with the
X.509 certificate the server presents.

It doesn't effect stunnel directly but you should consider the service
you're connecting to as potentially compromised. You can check to see
if they've recently issued a new certificate like this:

Download the server-side certificate
openssl s_client -connect {HOSTNAME}:{PORT} -showcerts

Check the validity dates:
openssl x509 -noout -in {FILENAME} -dates

This doesn't prove they have fixed the problem but, if the cert is older
than 7th April, it's probable that they have not. It's not bombproof
though as other systems besides openssl might be used for the TLS
transaction so their private keys have never been vulnerable.

[Jack Ryan]

Post by Zax
On Wed, 9 Apr 2014 01:51:54 -0500 (CDT), Jack Ryan wrote in

Post by Jack Ryan
Does anyone know?

The openssl heartbleed bug is server-side and enables an attacker to
read memory that potentially contains the secret key associated with the
X.509 certificate the server presents.

What next...?

Post by Zax
It doesn't effect stunnel directly but you should consider the service
you're connecting to as potentially compromised. You can check to see
Download the server-side certificate
openssl s_client -connect {HOSTNAME}:{PORT} -showcerts

Amazing what a random certificate says.

SSL handshake has read 2060 bytes and written 453 bytes
---
New, TLSv1/SSLv3, Cipher is AES256-SHA
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
Protocol : TLSv1
Cipher : AES256-SHA
Session-ID:
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXmunged

Certificate chain
0 s:/C=US/ST=Booya!/L=Big/O=Penis/OU=Available/CN=localhost

No shit.

Avast popped up a way to view the certificate and I exported it
to a .cer file from there.

Post by Zax
openssl x509 -noout -in {FILENAME} -dates

Jul 2 01:22:49 2013 GMT

Post by Zax
This doesn't prove they have fixed the problem but, if the cert is older
than 7th April, it's probable that they have not. It's not bombproof
though as other systems besides openssl might be used for the TLS
transaction so their private keys have never been vulnerable.
--
Key fingerprint = 1CD9 95E1 E9CE 80D6 C885 B7EB B471 80D5 2287 61E7
sub 4096R/4ABF07E3 2012-02-11 [expires: 2013-02-10]

[Ant]

Post by Jack Ryan
Does anyone know?

My Debian stable said it had to restart stunnel when I updated its
OpenSSL packages. :/
--
"The general, unable to control his irritation, will launch his men to
the assault like swarming ants, with the result that one-third of his
men are slain, while the town still remains untaken. Such are the
disastrous effects of a siege." --Chapter 3 in Sun Tzu's The Ancient Art
of War (Translated by Lionel Giles)
/\___/\ Ant(Dude) @ http://antfarm.ma.cx (Personal Web Site)
/ /\ /\ \ Ant's Quality Foraged Links: http://aqfl.net
| |o o| |
\ _ / If crediting, then use Ant nickname and AQFL URL/link.
( ) If e-mailing, then axe ANT from its address if needed.
Ant is currently not listening to any songs on this computer.

[Anonymous]

"The general, unable to control his irritation, will launch his men to the assault like swarming ants, with the result that one-third of his men are slain, while the town still remains untaken. Such are the disastrous effects of a siege."

Shades of the Dardanelles campaign.

[Khelair]

To: Ant
Re: Re: OpenSSL bug, is stunnel also compromised?
By: Ant to alt.privacy.anon-server,alt.privacy,comp.security.misc,comp.security.ssh on Wed Apr 09 2014 22:06:20

Post by Ant
My Debian stable said it had to restart stunnel when I updated its
OpenSSL packages. :/

Yeah, stunnel just sets up OpenSSL, doesn't it?

-- guh up the effbomb down wif yr bad self

--- Synchronet 3.16a-OpenBSD NewsLink 1.102
Tinfoil Tetrahedron: telnet://bismaninfo.hopto.org:8023/

[D. Stussy]

"Jack Ryan" wrote in message news:***@remailer.cpunk.us...
Does anyone know?
===========
ANY application that establishes a secure TCP tunnel may be affected by the
bug if the heartbeat ping is enabled in the SSL library.