[Xitami] EU: OpenSSL Security Update

[Thomas J. Hruska]

At 07:37 PM 8/19/2002 -0700, Jeff Hamblin writeth:
>> Affected Software:  ProtoNova v1.0-v1.1.  Xitami/Pro - all versions.
>> Apache (mod_ssl) - all versions.
>>
>> Security Issues:  A buffer overrun in the distributed OpenSSL binaries can
>> enable an attacker to execute arbitrary code on the local machine.  Other
>> serious security issues are also present in 0.9.6f and lower.
>>
>> Fix For Windows Users:  Install the Win32 OpenSSL project (0.9.6g) and
>> rename the old libeay32.dll and ssleay32.dll files to libeay32b.dll and
>> ssleay32b.dll in the directory where the web server is installed.
>
>Is an update going to be released for Xitami/Pro? Or is there
>some way to patch this ourselves? The fix described above
>does not seem to apply to Xitami/Pro -- I cannot find any of
>the files listed in the xitami directory, or anywhere on the
>system for that matter (Win2k Pro platform).

You are absolutely right about this.  It appears that the Xitami/Pro server
is statically linked with SSLeay - an ancient OpenSSL implementation -
v0.9.0 to be exact (according to the hex dump I have before me).  There is
no way to patch this yourself.  iMatix should dynamically bind this library
for future releases of their SSL-capable server.

I'm sorry that I can't help you beyond this, but it is now imperative that
iMatix get a fix out for the problem ASAP as well as dynamically linking to
OpenSSL to avoid future hassles.  If you want to read more about it, you
can find the Security Advisory here:

<http://www.openssl.org/news/secadv_20020730.txt>

Note that it says that SSLeay is "probably also affected."  I would
consider anyone running an unpatched/unfixed production server to be
walking in dangerous territory and should take down any production
Xitami/Pro servers until iMatix fixes this.  It was serious enough to
generate a panic attack across the entire _world_ and generated THREE
different OpenSSL releases (two occured within 24 hours of each other) to
finally fix the problems.  0.9.6g is the latest, stable release.

Exploits exist for one of the buffer overflow vulnerabilities, but the code
is claimed to be "unreleased."  The fact that such code exists should send
everyone into hiding.  I suspect that in the next couple months we will see
unpatched/unfixed servers being changed remotely via malicious scripts.

iMatix, what is the status on this issue?

Hope this helps!


          Thomas J. Hruska -- shinelight@shininglightpro.com
Shining Light Productions -- "Meeting the needs of fellow programmers"
                  http://www.shininglightpro.com/