Feeds

OpenSSL updated to kill code-execution bug

Remotely exploitable

Combat fraud and increase customer satisfaction

The OpenSSL server has been updated to fix a security bug that could be remotely exploited to potentially install malware on vulnerable systems.

The race condition flaw in the OpenSSL TLS server extension code could be exploited in a buffer overrun attack, maintainers of the open-source SSL and TLS application warned on Tuesday. All versions of OpenSSL that support TLS extensions are vulnerable, including OpenSSL 0.9.8f through 0.9.8o, 1.0.0, and 1.0.0a. Apache HTTP server and Stunnel are not affected.

“Any OpenSSL based TLS server is vulnerable if it is multi-threaded and uses OpenSSL's internal caching mechanism,” members of the OpenSSL Project wrote. “Servers that are multi-process and/or disable internal session caching are NOT affected.”

Members of the Red Hat Security Response Team, which uses OpenSSL in Red Hat Enterprise Linux, warned the vulnerability could be remotely exploited.

“Under certain specific conditions, it may be possible for a remote attacker to trigger this race condition and cause such an application to crash, or possibly execute arbitrary code with the permissions of the application,” they wrote. ®

Combat fraud and increase customer satisfaction

Whitepapers

Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.