Berkeley CSUA MOTD:Entry 10390
Berkeley CSUA MOTD
 
WIKI | FAQ | Tech FAQ
http://csua.com/feed/
2025/05/25 [General] UID:1000 Activity:popular
5/25    

2003/10/1-3 [Computer/SW/Security, Computer/SW/WWW/Server] UID:10390 Activity:nil
10/1    OpenSSL vulnerabilities.  Patchpatchpatch...
        http://www.openssl.org/news/secadv_20030930.txt  -John
        \_ is it enough to get install the new ssl rpm or does my mod_ssl
           need to be recompiled?
           \_ depends on whether mod_ssl is linked statically or not. I believe
              it's not since the only new RedHat updates that showed up today
              are openssl ones. In general, they a rarely use static linking,
              so to update a library, you just need to install the new library
              rpm and not worry about the applications that use it.
        \_ My new plan.  Fuck ssh/ssl.  I'm changing all external connections
           to vpn-only and then filtering the shit out of who is allowed to
           even try to connect to that.
                \_ Oh *that* will work.  Because we all know that every VPN
                   solution out there is utterly foolproof and secure.  Nobody
                   ever cracked DES or IOS.  Blanket statements like that are
                   incredibly ignorant and dangerous (although if it makes you
                   feel safer, go ahead.)  There is nothing fundamentally
                   wrong with OpenSSH/SSL--no computer or software is or
                   will ever be 100% secure.  Just patch the fucking thing
                   and get on with your life.  There'll be others.  -John
                   \_ You're so ... manly! when you talk about security, John.
                      It makes my heart go "thump! thump! thump!"  Can I have
                      your love child?  Your IPSEC key?
        \_ DOS vulnerability.  Not remote exploit.
2025/05/25 [General] UID:1000 Activity:popular
5/25    

You may also be interested in these entries...
2012/5/8-6/4 [Computer/SW/Unix] UID:54383 Activity:nil
5/8     Hello everyone!  This is Josh Hawn, CSUA Tech VP for Spring 2012.
        About 2 weeks ago, someone brought to my attention that our script
        to periodically merge /etc/motd.public into /etc/motd wasn't
        running.  When I looked into it, the cron daemon was running, but
        there hadn't been any root activity in the log since April 7th.  I
        looked into it for a while, but got lost in other things I was
	...
2011/11/16-12/28 [Academia/Berkeley/CSUA, Computer/HW] UID:54230 Activity:nil
11/16   We'll be taking all CSUA machines offline in the near future for a Soda
        Hall server room reorganization (we're being moved to a neighboring
        server cabinet).  Downtime will hopefully be minimal.  --jordan
        \_ Thanks for all your work keeping the machines running!  It's
           been awesome having soda actually working again.
        \_ Update:  this is tentatively scheduled for Saturday afternoon.
	...
2011/8/9-27 [Computer/SW/Editors/Emacs, Academia/Berkeley/CSUA] UID:54162 Activity:nil
8/9     So I just found out that an old college friend of mine lost her
        four month old daughter to SIDS. What is the correct response here?
        \_ "Did she sleep with her belly?" and "Did you breastfeed?"
        \_ try this joke:
           How do you make a dead baby float?
           ˙ʎqɐq pɐǝp ÉŸo sdooÉ”s oʍʇ puɐ ɹÇ\
	...
2010/11/21-2011/1/13 [Computer/SW/Languages/Web] UID:53988 Activity:moderate
11/21   Lifehacker's recommending Dreamhost as a personal web hosting service.
        Apart from csua, who do you guys use? --erikred
        \_ What do you want to use it for? Do you need CGI or PHP?  My
           brother worked for Dreamhost and said they are unethical. In
           fact, he sued them. This refers to their treatment of customers
           and employees both. I don't know who  or what "Lifehacker" is,
	...
2010/11/1-2011/1/13 [Computer/Networking] UID:54002 Activity:nil
11/1    I'm moving from a home in Fremont to another home within the same ZIP
        code in Fremont, and AT&T customer service says I cannot transfer my
        DSL service because DSL is not available at my new home.  Is that BS?
        Are they just trying to push me to subscribe to their more expensive
        U-verse service?  I'm not asking for any lightening-speed connection.
            \_ could be
	...
2010/8/10-9/7 [Computer/Companies/Google] UID:53919 Activity:nil
8/10    http://www.businessinsider.com/google-puts-wave-out-of-its-misery-2010-8
        Google Wave No More. The people who worked on it were pretty smart.
        They wrote up a super awesome OKR with extremely low bar as a measure
        of success, exceeded everyone's expectations by going above those
        bars, and got big fat bonuses and promotions as a result of their
        planning. Brilliant.
	...
2008/5/14-16 [Computer/SW/OS/Linux] UID:49941 Activity:nil
5/14    debian people, recompile:
        http://metasploit.com/users//hdm/tools/debian-openssl
        \- and ubuntu
           \_ Which is derived from debian.
        \_ Argh. What are some inexpensive certificate authorities?
	...
2007/2/20-22 [Computer/SW/WWW/Server, Computer/SW/Security] UID:45782 Activity:high
2/20    Any recommendations on a cheap/easy-to-use digital signature system?
        \- i dunno exactly wat you are looking for or what the status of this
           project is, but if the obvious [gnupg] wont do, you can google
           for AKENTI. --psb
        \_ What do you want exactly?  A toolkit for digitally signing various
           files?  OpenSSL is free.  It is, however, a pain in the ass to use,
	...
2006/9/8-12 [Computer/SW/Unix, Computer/SW/Security, Computer/SW/WWW/Server] UID:44325 Activity:nil
9/9     Is there a gzip-like unix command that will encrypt a file?
        I'm looking for something that's widely available. Thanks
        crypt (not very secure - DES).  Or failing that, openssl or gnupg
        \_ openssl or gnupg... what are you looking for?  Those will work fine..
           \_ Thanks for the recommendations. I'm basically experimenting
              with a way of using my friend's computer to backup my
	...
2006/3/2 [Computer/SW/Languages/Perl] UID:42064 Activity:kinda low
3/2     LDAP help: I am trying to dump the userPassword from an ldap database
        with ldapsearch but it is coming out base64 encoded:
        userPassword:: e2NyeXB0fWhhKllueGJrSXhrR2M=
        Is there a shell tool to decode this ... I want to avoid re-writing
        the whole thing in perl (I'm not that familar with LDAP or encodings
        and this isn't important enough to spend a lot of time on ... but I've
	...
2006/2/13-15 [Computer/Networking] UID:41829 Activity:nil
2/13    Do I really have to point my cisco pix at some cert. authority
        if I want to use keys (instead of "pre-shared secrets") ?
        I can't just self sign?? wtf?
        \_ Actually, why not just create a CA signing cert with OpenSSL
           (it's not that hard), sign a cert with that, and then import the
           CA public key into pix?  Or use a static passphrase for phase I
	...
2005/4/30-5/3 [Computer/SW/WWW/Browsers] UID:37434 Activity:moderate
4/30    In Outlook Express I get an error message everytime I check my
        CSUA account, although I still get my mail.  I am using POP port 995
        with SSL.  Is there a way I can prevent this message, it's annoying:
        "The server you are connected to is using a security certificate that
        could not be verified.  A certificate chain processed, but terminated
        in a root certificate which is not trusted by the trust provider.  Do
	...
2005/3/19-22 [Computer/SW/WWW/Browsers] UID:36770 Activity:low
3/19    Is there a way to get Mozilla under Windows to use mystore to manage
        certificates rather than its own internal cert manager?  I have a
        DER-encoded client cert that's usable by IE, but I'd like to see
        it used by Mozilla (which requires PKCS#12 certs for its own store,
        rather than DER or p7b.)  -John
        \_ It is possible to conver between DER and PKCS#12 (I believe that
	...
2004/6/7 [Computer/SW/Security] UID:30642 Activity:nil
6/5     I can't reach some sites from my company, including sameer's
        anonymizer. What are some good anonymizing sites I can use? Thanks.
        \_ I recommend setting up nph-proxy or something similar on your
           home machine.  For added yuks, run it over OpenSSL and password
           protect it.  -John
	...
2004/5/28-29 [Computer/SW/OS/Linux, Computer/SW/OS/FreeBSD] UID:30467 Activity:high
5/27    In what ways are FreeBSD superior to a good Linux distro?
        \_ Why do you hate Windows?
           \_ Why do you hate Linus?
        \_ *BSD has a better IP stack.
           \_ In what way?
           \_ Aren't they the same now?
	...
2004/5/27 [Computer/SW/WWW/Server] UID:30458 Activity:high
5/27    MacOS X Mail complains about soda's certificate when connecting over
        SSL.  Is there a way to silence it?  Is there a public x509 certificate
        around here?  The stuff in /etc/ssl/certs isn't readable by anyone but
        root.   -jeffwong
        \_ There's a way to get Mail to suppress the warning... sorry, but I
           don't remember what it is off the top of my head.
	...
2004/5/7 [Computer/SW/WWW/Browsers] UID:30076 Activity:nil
5/6     Installed lynx with openssl and now I have the following msg:
        "unable to get local issuer certificate"
        What's going on?
	...
2004/3/25-28 [Computer/SW/Security, Computer/SW/Unix] UID:12868 Activity:moderate
3/25    as of today i can't get my imaps mail off of csua port 993. anyone
        else have this problem?
        \_ I have this problem not, with openssl as the connector.
           * OK [CAPABILITY IMAP4REV1 LOGIN-REFERRALS AUTH=PLAIN AUTH=LOGIN]
             http://soda.CSUA.Berkeley.EDU IMAP4rev1 2002.332 at Thu, 25 Mar 2004
             19:23:26 -0800 (PST)
	...
Cache (1228 bytes)
www.openssl.org/news/secadv_20030930.txt
A bug in OpenSSLs SSL/TLS protocol was also identified which causes OpenSSL to parse a client certificate from an SSL/TLS client when it should reject it as a protocol error. Certain ASN1 encodings that are rejected as invalid by the parser can trigger a bug in the deallocation of the corresponding data structure, corrupting the stack. It is currently unknown whether this can be exploited to run malicious code. Unusual ASN1 tag values can cause an out of bounds read under certain circumstances, resulting in a denial of service vulnerability. A malformed public key in a certificate will crash the verify code if it is set to ignore public key decoding errors. Public key decode errors are not normally ignored, except for debugging purposes, so this is unlikely to affect production code. Exploitation of an affected application would result in a denial of service vulnerability. Due to an error in the SSL/TLS protocol handling, a server will parse a client certificate when one is not specifically requested. This by itself is not strictly speaking a vulnerability but it does mean that all SSL/TLS servers that use OpenSSL can be attacked using vulnerabilities 1, 2 and 3 even if they dont enable client authentication.