[11634] in cryptography@c2.net mail archive
Re: OpenSSL worm in the wild
daemon@ATHENA.MIT.EDU (Eric Rescorla)
Fri Sep 13 17:12:25 2002
To: Dave Ahmad <da@securityfocus.com>
Cc: Ben Laurie <ben@algroup.co.uk>,
Bugtraq <BUGTRAQ@securityfocus.com>,
Cryptography <cryptography@wasabisystems.com>,
cypherpunks <cypherpunks@einstein.ssz.com>,
Apache SSL <apache-ssl@lists.aldigital.co.uk>
Reply-To: EKR <ekr@rtfm.com>
From: Eric Rescorla <ekr@rtfm.com>
Date: 13 Sep 2002 14:08:43 -0700
In-Reply-To: Eric Rescorla's message of "13 Sep 2002 13:37:08 -0700"
Eric Rescorla <ekr@rtfm.com> writes:
> especially
> since one could easily modify the worm to attack all servers
> or, perhaps, those which only display Product ID :)
... or maybe not.
I hadn't seen a copy of the worm yet, so I guessed from your
description that it was using the Server: value to detect who is
running downrev versions of OpenSSL. Not so.
Upon examination, it looks like the worm uses the server version to
decide what section of memory to overwrite (based on the target OS)
and server version. So, if people reconfiged their servers to not give
you this information, a worm author would either have to have the worm
try all possible exploits (not a big deal with only 20 architectures
to search) or have some other evidence as to what OS/Apache version
people were runnning.
Note that for this to be a 100% countermeasure you'd have to
reconfigure your server not to advertise Apache at all. Otherwise,
it looks to me like the worm assumes that you're running
Red Hat/Apache 1.3.23, in which case there's a real chance
that the worm will crash your server by using the wrong
overwrite offset.
-Ekr
--
[Eric Rescorla ekr@rtfm.com]
http://www.rtfm.com/
---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo@wasabisystems.com
