[Xitami] Crashing cont'd (OpenSSL/SSLeay...)

[Thomas J. Hruska]

At 10:59 PM 11/4/2002 -0800, Stefan Pantazi writeth:
>Thanks Thomas,
>No, I have no updates. Never been contacted for any. I guess I'll just have
>to continue to keep my eyes on the server. I am monitoring it continuously.
>I hope that I covered all obvious holes and that nobody becomes interested
>in hacking it because I know it is possible. I also hope that no hacker will
>actually spend time on finding out how they can hack xitami since the SSL
>code is statically liked into xitami executable rather than being a dll or a
>separate module.

I was only asking this because I do not personally own XiPro, but know
about the implications of iMatix not spending 2-3 hours to re-compile XiPro
and distribute the fixed version.

Exploit code does exist for the OpenSSL/SSLeay security holes, but I am not
sure how widely available it is.  The fact that such code exists basically
blows any security measures completely out of the water that you (and
others) have taken to create a secure environment.  If done properly,
exploit code can allow OpenSSL to run as usual and snag plain-text
transfers and forward them to some other location...e.g. unencrypted free
credit card numbers, addresses, e-mail, personal information, etc.  It
would take weeks/months/years(?) to figure out what happened since the
attacker is a remote machine acting passively except for one request.
Basically, this allows for something the equivalent of CodeRed I and II for
Xitami, Apache, and anything else not running on a fixed OpenSSL code base.

The best solution is probably to complain to iMatix that you paid good
money for a good product and you want at least some sort of fix for this
problem (even if they just recompile and statically link OpenSSL v0.9.6g
with XiPro, it would be better than doing nothing at all).

Hope this helps!


          Thomas J. Hruska -- shinelight@shininglightpro.com
Shining Light Productions -- "Meeting the needs of fellow programmers"
                  http://www.shininglightpro.com/