LibreSSL not affected by DROWN attack

Contributed by phessler on 2016-03-01 from the super-duper-tuesday dept.

As noted by Bernard Spil, the OpenSSL bugs disclosed on 2016-03-01 have very little impact on LibreSSL, especially on OpenBSD. However, we will briefly mention the two high-profile issues:

LibreSSL (on any platform) is not affected by DROWN. Support for SSLv2 was flensed out quite a while ago.

Cachebleed is local-only, and requires a lot effort to get. This is thought to be very difficult to exploit on OpenBSD due to many of the normal mitigations on an OpenBSD system. Other systems without such mitigations may not be so lucky.

(Comments are closed)

Comments

By Noryungi (noryungi) noryungi@yahoo.com on 2016-03-01 14:59

Does that mean we will still get a patch for the "Cachebleed", even if it is only a local vulnerability?
Comments
1. By Anonymous Coward (82.68.199.130) on 2016-03-02 10:12
  
  > Does that mean we will still get a patch for the "Cachebleed", even if it is only a local vulnerability?
  
  It is being looked at, but cannot be rushed as a mistake in fixing this could result in a much bigger problem.
  
  Read the FAQ (https://ssrg.nicta.com.au/projects/TS/cachebleed/) especially Q5.
  Comments
  1. By Anonymous Coward (83.97.184.235) on 2016-03-03 00:08
    
    "If you risk freedom or life by speaking up, leave empty (gets posted as Anonymous Coward), otherwise take credit and responsiblity for your words (you do think it's worth submitting, after all)"
    
    Publish a anonymous message makes one a coward in this community? I think what is really coward is to do it with a fake name. It has been probed that the anonymity is more good synonymous with humility; and humility is condition, in my opinion, without which no one can be honest.
By Anonymous Coward (89.163.220.14) on 2016-03-02 02:44

You know the bugs get serious when they are given names which have to do with misadventure, death, serious injury, fluffy animals, or a combination of such items.

Latest Articles

Sat, Nov 30
- 18:42 Initial list of 21 EuroBSDcon 2024 videos released (0)
- 18:39 Rafael Sadowski on dpb(1) (1)
Fri, Nov 29
- 09:31 -current now has more flexible performance policy (0)
Mon, Nov 25
- 07:13 unwind: wildcard in blacklist (0)
Fri, Nov 22
- 07:33 Game of Trees 0.106 released (0)
Fri, Nov 15
- 06:51 Game of Trees 0.105 released (0)
Wed, Oct 23
- 07:12 Game of Trees 0.104 released (0)
Tue, Oct 15
- 08:46 LibreSSL 4.0.0 Released (0)
Mon, Oct 14
- 07:05 sshd(8) splitting continues (1)

Credits

Copyright © 2004-2008 Daniel Hartmeier. All rights reserved. Articles and comments are copyright their respective authors, submission implies license to publish on this web site. Contents of the archive prior to April 2nd 2004 as well as images and HTML templates were copied from the fabulous original deadly.org with Jose's and Jim's kind permission. This journal runs as CGI with httpd(8) on OpenBSD, the source code is BSD licensed. undeadly \Un*dead"ly\, a. Not subject to death; immortal. [Obs.]