1. Home

Product groups

Support

New OpenSSL vulnerability - WeOnlyDo Discussion board

New OpenSSL vulnerability (wodSSH / wodSSH.NET)

by Mark, Thursday, May 05, 2016, 23:36 (2906 days ago) @ Jasmine

I believe the below vulnerability affects 1.0.2g.

Thanks,
Mark


CVE-2016-2107 (OpenSSL advisory) [High severity] 3rd May 2016:

A MITM attacker can use a padding oracle attack to decrypt traffic when the connection uses an AES CBC cipher and the server support AES-NI. This issue was introduced as part of the fix for Lucky 13 padding attack (CVE-2013-0169). The padding check was rewritten to be in constant time by making sure that always the same bytes are read and compared against either the MAC or padding bytes. But it no longer checked that there was enough data to have both the MAC and padding bytes. Reported by Juraj Somorovsky.
Fixed in OpenSSL 1.0.1t (Affected 1.0.1s, 1.0.1r, 1.0.1q, 1.0.1p, 1.0.1o, 1.0.1n, 1.0.1m, 1.0.1l, 1.0.1k, 1.0.1j, 1.0.1i, 1.0.1h, 1.0.1g, 1.0.1f, 1.0.1e, 1.0.1d, 1.0.1c, 1.0.1b, 1.0.1a, 1.0.1)
Fixed in OpenSSL 1.0.2h (Affected 1.0.2g, 1.0.2f, 1.0.2e, 1.0.2d, 1.0.2c, 1.0.2b, 1.0.2a, 1.0.2)

locked
4515 views

Complete thread:

 

Not only wodSFTPdll is excellent, the service you have provided is outstanding and second to none!

Ian D. Mead, author of UltraEdit-32
IDM Computer Solutions

It is very refreshing to find such helpful, knowledgeable and quick responding technical support.

Jason Sears
CompuSource Systems, Inc.

...with the SFTP interface you produced, everything was so simple to understand, we were able to start coding almost immediately!

Zack Menendez
Mapframe Corporation

Thanks! We love your software and your great support!

Sandy Fliderman
Primary Development Corporation

I really like these products - they are consistently first rate!

David Witten
WWR Development, Inc.

You made it so simple for us to integrate SFTP - a technology we had little experience with...

Zack Menendez
Mapframe Corporation

Your component works really great. With minor effort I have been able to convert my delphi application...

Gilles Hache
Cisco Systems Inc.

You made it so simple for us to integrate SFTP - a technology we had little experience with...

Zack Menendez
Mapframe Corporation

Your professionalism is reflected into your email, your product and your web site. I am confident that these will make the difference.

Sylvain Paquette
R&D Analyst at InfoPharm Inc.

You have been great as far as offering support is concerned and has been extremely responsive to both support requests and suggestions for product enhancements.

David Keenan
Serengeti Systems Incorporated