[Xitami] EU: OpenSSL Security Update

[Thomas J. Hruska]

This EU (Emergency Update) is being released in relation to OpenSSL
courtesy of Shining Light Productions.

Affected Software:  ProtoNova v1.0-v1.1.  Xitami/Pro - all versions.
Apache (mod_ssl) - all versions.

Security Issues:  A buffer overrun in the distributed OpenSSL binaries can
enable an attacker to execute arbitrary code on the local machine.  Other
serious security issues are also present in 0.9.6f and lower.

Fix For Windows Users:  Install the Win32 OpenSSL project (0.9.6g) and
rename the old libeay32.dll and ssleay32.dll files to libeay32b.dll and
ssleay32b.dll in the directory where the web server is installed.  Restart
the web server.  If the web server crashes complaining about one of the
OpenSSL DLLs, then rename the files back and wait for an official fix for
the web server.  If local, state, or country laws affect the default build
of OpenSSL, then OpenSSL will have to be built from the ground up.

Alternative Fix:  Download the source code to OpenSSL 0.9.6g from
<http://www.openssl.org/source/> and build it from the ground up.  Takes
approximately 5-30 minutes to build depending on hardware capabilities and
software installed.

Additional Notes:  The Win32 OpenSSL project can be found here:
http://www.shininglightpro.com/search.php?searchname=Win32+OpenSSL



          Thomas J. Hruska -- shinelight@shininglightpro.com
Shining Light Productions -- "Meeting the needs of fellow programmers"
                  http://www.shininglightpro.com/