[Xitami] Crashing cont'd (OpenSSL/SSLeay...)

[Stefan Pantazi]

Thanks Thomas,
No, I have no updates. Never been contacted for any. I guess I'll just have
to continue to keep my eyes on the server. I am monitoring it continuously.
I hope that I covered all obvious holes and that nobody becomes interested
in hacking it because I know it is possible. I also hope that no hacker will
actually spend time on finding out how they can hack xitami since the SSL
code is statically liked into xitami executable rather than being a dll or a
separate module.

Stefan

> Stefan, has iMatix updated XiPro recently to fix the serious security
> issues pertaining to SSLeay embedded in their code base (that is, have you
> received any updated executables from iMatix)?
>
> The last I knew, they have not updated the server and this leaves the
> Xitami Pro web server open to several __very__ serious security
> issues that
> allow multiple buffer overflow attacks (at least one of which code already
> exists).  iMatix has known about these attacks for about 3 months now and
> as far as I know they have done nothing about it.  If they have fixed this
> problem, then that is one more thing that can be checked off of
> my internal
> bug list.
>