topic OpenSSL CVE-2010-3864 in Operating System - HP-UX

OpenSSL CVE-2010-3864

Steve Hinchman — Tue, 23 Nov 2010 20:44:06 GMT

Before version 9.08p is released by HP for distribution, the recommended fix is:

1. Confirm that internal session caching is disabled or
2. the implementation is not multi-threaded.

Can someone please tell me how perform step 1 and verify step 2.

Regards,
Steve Hinchman

Re: OpenSSL CVE-2010-3864

vaasusworld — Wed, 24 Nov 2010 04:46:15 GMT

Hi,

Generally you can enables/disables session caching by setting the mode in â SSL_CTX_set_session_cache_mode (SSL_CTX ctx, long mode)â function.

Mode "SSL_SESS_CACHE_OFF" means, no session caching for client or server takes place.

The default mode is SSL_SESS_CACHE_SERVER, means it is enabled by default.

You can find more information in the below link...

http://www.openssl.org/docs/ssl/SSL_CTX_set_session_cache_mode.html

Thanks & Regards,
Vasu

Re: OpenSSL CVE-2010-3864

vaasusworld — Wed, 24 Nov 2010 06:01:46 GMT

Hi,

OpenSSL can also be used in multi-threaded applications.

Regards,
Vasu

Re: OpenSSL CVE-2010-3864

Steve Hinchman — Wed, 24 Nov 2010 15:41:30 GMT

Vasu,

Thanks for the replies.

So, if I understand correctly, both issues are dependent upon the application calling/using OpenSSL's TSL, correct?

For example, does Tomcat need to be configured to enable/disable internal session caching? Or is it set by application using Tomcat?

Regards,
Steve

Re: OpenSSL CVE-2010-3864

vaasusworld — Sun, 28 Nov 2010 07:18:21 GMT

>> So, if I understand correctly, both issues are dependent upon the application calling/using OpenSSL's TSL, correct?

The answer is YES.

Regards,
Vasu