OpenSSL Timing Attack RSA私钥信息泄露漏洞发布时间：2003-03-14 更新时间：2003-04-08 严重程度：高 威胁程度：口令恢复 错误类型：配置错误 利用方式：服务器模式 BUGTRAQ ID：7101 CVE(CAN) ID：CAN-2003-0147 受影响系统 OpenPKG OpenPKG Current详细描述 OpenSSL实现存在漏洞可导致目标服务器上的RSA私钥泄露，在客户端与服务器端会话密钥协商过程中的部分时序操作存在问题，攻击者可以通过分析这些细腻获得目标服务器端的RSA私钥信息。 详细文章可参看如下地址： http://crypto.stanford.edu/~dabo/abstracts/ssl-timing.html 测试代码 尚无 解决方案 补丁下载： Index: crypto/rsa/rsa_eay.c =================================================================== RCS file: /e/openssl/cvs/openssl/crypto/rsa/rsa_eay.c,v retrieving revision 1.28.2.3 diff -u -r1.28.2.3 rsa_eay.c --- crypto/rsa/rsa_eay.c 30 Jan 2003 17:37:46 -0000 1.28.2.3 +++ crypto/rsa/rsa_eay.c 16 Mar 2003 10:34:13 -0000 @@ -195,6 +195,25 @@ return(r); } +static int rsa_eay_blinding(RSA *rsa, BN_CTX *ctx) + { + int ret = 1; + CRYPTO_w_lock(CRYPTO_LOCK_RSA); + /* Check again inside the lock - the macro's check is racey */ + if(rsa->blinding == NULL) + ret = RSA_blinding_on(rsa, ctx); + CRYPTO_w_unlock(CRYPTO_LOCK_RSA); + return ret; + } + +#define BLINDING_HELPER(rsa, ctx, err_instr) + do { + if(((rsa)->flags & RSA_FLAG_BLINDING) && + ((rsa)->blinding == NULL) && + !rsa_eay_blinding(rsa, ctx)) + err_instr + } while(0) + /* signing */ static int RSA_eay_private_encrypt(int flen, const unsigned char *from, unsigned char *to, RSA *rsa, int padding) @@ -239,8 +258,8 @@ goto err; } - if ((rsa->flags & RSA_FLAG_BLINDING) && (rsa->blinding == NULL)) - RSA_blinding_on(rsa,ctx); + BLINDING_HELPER(rsa, ctx, goto err;); + if (rsa->flags & RSA_FLAG_BLINDING) if (!BN_BLINDING_convert(&f,rsa->blinding,ctx)) goto err; @@ -318,8 +337,8 @@ goto err; } - if ((rsa->flags & RSA_FLAG_BLINDING) && (rsa->blinding == NULL)) - RSA_blinding_on(rsa,ctx); + BLINDING_HELPER(rsa, ctx, goto err;); + if (rsa->flags & RSA_FLAG_BLINDING) if (!BN_BLINDING_convert(&f,rsa->blinding,ctx)) goto err; Index: crypto/rsa/rsa_lib.c =================================================================== RCS file: /e/openssl/cvs/openssl/crypto/rsa/rsa_lib.c,v retrieving revision 1.30.2.2 diff -u -r1.30.2.2 rsa_lib.c --- crypto/rsa/rsa_lib.c 30 Jan 2003 17:37:46 -0000 1.30.2.2 +++ crypto/rsa/rsa_lib.c 16 Mar 2003 10:34:13 -0000 @@ -72,7 +72,13 @@ RSA *RSA_new(void) { - return(RSA_new_method(NULL)); + RSA *r=RSA_new_method(NULL); + +#ifndef OPENSSL_NO_FORCE_RSA_BLINDING + r->flags|=RSA_FLAG_BLINDING; +#endif + + return r; } void RSA_set_default_method(const RSA_METHOD *meth) OpenPKG OpenPKG Current: OpenPKG Upgrade apache-1.3.27-20030318.src.rpm ftp://ftp.openpkg.org/current/SRC/apache-1.3.27-20030318.src.rpm OpenPKG OpenPKG 1.1: OpenPKG Upgrade apache-1.3.26-1.1.4.src.rpm ftp://ftp.openpkg.org/release/1.1/UPD/apache-1.3.26-1.1.4.src.rpm OpenPKG OpenPKG 1.2: OpenPKG Upgrade apache-1.3.27-1.2.2.src.rpm ftp://ftp.openpkg.org/release/1.2/UPD/apache-1.3.27-1.2.2.src.rpm OpenSSL Project OpenSSL 0.9.6 i: Mandrake Patch libopenssl0-static-devel-0.9.6i-1.4mdk.i586.rpm http://www.mandrakesecure.net/en/ftp.php Corporate Server 2.1 Mandrake Patch libopenssl0-static-devel-0.9.6i-1.4mdk.ia64.rpm http://www.mandrakesecure.net/en/ftp.php Mandrake Linux 8.1/IA64 Mandrake Patch libopenssl0-static-devel-0.9.6i-1.4mdk.ppc.rpm http://www.mandrakesecure.net/en/ftp.php Mandrake Linux 8.2/PPC Mandrake Patch openssl-0.9.6i-1.3mdk.i586.rpm http://www.mandrakesecure.net/en/ftp.php Mandrake Linux 8.0 Mandrake Patch openssl-0.9.6i-1.3mdk.ppc.rpm http://www.mandrakesecure.net/en/ftp.php Mandrake Linux 8.0/PPC Mandrake Patch openssl-0.9.6i-1.4mdk.i586.rpm http://www.mandrakesecure.net/en/ftp.php Mandrake Linux 8.1 Mandrake Patch openssl-0.9.6i-1.4mdk.i586.rpm http://www.mandrakesecure.net/en/ftp.php Mandrake Linux 8.2 Mandrake Patch openssl-0.9.6i-1.4mdk.i586.rpm http://www.mandrakesecure.net/en/ftp.php Mandrake Linux 9.0 Mandrake Patch openssl-0.9.6i-1.4mdk.i586.rpm http://www.mandrakesecure.net/en/ftp.php Multi Network Firewall 8.2 Mandrake Patch openssl-0.9.6i-1.4mdk.i586.rpm http://www.mandrakesecure.net/en/ftp.php Corporate Server 2.1 Mandrake Patch openssl-0.9.6i-1.4mdk.ia64.rpm http://www.mandrakesecure.net/en/ftp.php Mandrake Linux 8.1/IA64 Mandrake Patch openssl-0.9.6i-1.4mdk.ppc.rpm http://www.mandrakesecure.net/en/ftp.php Mandrake Linux 8.2/PPC OpenSSL Project Upgrade openssl-0.9.6j.tar.gz http://www.openssl.org/source/openssl-0.9.6j.tar.gz Mandrake Patch libopenssl0-0.9.6i-1.1mdk.i586.rpm http://www.mandrakesecure.net/en/ftp.php Mandrake Linux 9.1 Mandrake Patch libopenssl0-0.9.6i-1.1mdk.ppc.rpm http://www.mandrakesecure.net/en/ftp.php Mandrake Linux 9.1/PPC Mandrake Patch libopenssl0-0.9.6i-1.4mdk.i586.rpm http://www.mandrakesecure.net/en/ftp.php Multi Network Firewall 8.2 Mandrake Patch libopenssl0-0.9.6i-1.4mdk.i586.rpm http://www.mandrakesecure.net/en/ftp.php Mandrake Linux 9.0 Mandrake Patch libopenssl0-0.9.6i-1.4mdk.i586.rpm http://www.mandrakesecure.net/en/ftp.php Mandrake Linux 8.1 Mandrake Patch libopenssl0-0.9.6i-1.4mdk.i586.rpm http://www.mandrakesecure.net/en/ftp.php Mandrake Linux 8.2 Mandrake Patch libopenssl0-0.9.6i-1.4mdk.i586.rpm http://www.mandrakesecure.net/en/ftp.php Corporate Server 2.1 Mandrake Patch libopenssl0-0.9.6i-1.4mdk.ia64.rpm http://www.mandrakesecure.net/en/ftp.php Mandrake Linux 8.1/IA64 Mandrake Patch libopenssl0-0.9.6i-1.4mdk.ppc.rpm http://www.mandrakesecure.net/en/ftp.php Mandrake Linux 8.2/PPC Mandrake Patch libopenssl0-devel-0.9.6i-1.4mdk.i586.rpm http://www.mandrakesecure.net/en/ftp.php Mandrake Linux 9.0 Mandrake Patch libopenssl0-devel-0.9.6i-1.4mdk.i586.rpm http://www.mandrakesecure.net/en/ftp.php Mandrake Linux 8.2 Mandrake Patch libopenssl0-devel-0.9.6i-1.4mdk.i586.rpm http://www.mandrakesecure.net/en/ftp.php Corporate Server 2.1 Mandrake Patch libopenssl0-devel-0.9.6i-1.4mdk.ia64.rpm http://www.mandrakesecure.net/en/ftp.php Mandrake Linux 8.1/IA64 Mandrake Patch libopenssl0-devel-0.9.6i-1.4mdk.ppc.rpm http://www.mandrakesecure.net/en/ftp.php Mandrake Linux 8.2/PPC Mandrake Patch libopenssl0-static-devel-0.9.6i-1.4mdk.i586.rpm http://www.mandrakesecure.net/en/ftp.php Mandrake Linux 9.0 Mandrake Patch libopenssl0-static-devel-0.9.6i-1.4mdk.i586.rpm http://www.mandrakesecure.net/en/ftp.php Mandrake Linux 8.1 Mandrake Patch libopenssl0-static-devel-0.9.6i-1.4mdk.i586.rpm http://www.mandrakesecure.net/en/ftp.php Mandrake Linux 8.2 OpenSSL Project OpenSSL 0.9.6 h: OpenSSL Project Upgrade openssl-0.9.6j.tar.gz http://www.openssl.org/source/openssl-0.9.6j.tar.gz OpenSSL Project OpenSSL 0.9.6 g: OpenPKG Upgrade openssl-0.9.6g-1.1.0.src.rpm ftp://ftp.openpkg.org/release/1.1/UPD/openssl-0.9.6g-1.1.0.src.rpm OpenPKG 1.1 OpenSSL Project Upgrade openssl-0.9.6j.tar.gz http://www.openssl.org/source/openssl-0.9.6j.tar.gz OpenSSL Project OpenSSL 0.9.6 e: OpenSSL Project Upgrade openssl-0.9.6j.tar.gz http://www.openssl.org/source/openssl-0.9.6j.tar.gz OpenSSL Project OpenSSL 0.9.6 d: OpenSSL Project Upgrade openssl-0.9.6j.tar.gz http://www.openssl.org/source/openssl-0.9.6j.tar.gz OpenSSL Project OpenSSL 0.9.6 c: OpenSSL Project Upgrade openssl-0.9.6j.tar.gz http://www.openssl.org/source/openssl-0.9.6j.tar.gz Conectiva Upgrade openssl-0.9.6c-2U80_5cl.i386.rpm ftp://atualizacoes.conectiva.com.br/8/RPMS/openssl-0.9.6c-2U80_5cl.i386.rpm Conectiva Upgrade openssl-devel-0.9.6c-2U80_5cl.i386.rpm ftp://atualizacoes.conectiva.com.br/8/RPMS/openssl-devel-0.9.6c-2U80_5cl.i386.rpm Conectiva Upgrade openssl-devel-static-0.9.6c-2U80_5cl.i386.rpm ftp://atualizacoes.conectiva.com.br/8/RPMS/openssl-devel-static-0.9.6c-2U80_5cl.i386.rpm Conectiva Upgrade openssl-doc-0.9.6c-2U80_5cl.i386.rpm ftp://atualizacoes.conectiva.com.br/8/RPMS/openssl-doc-0.9.6c-2U80_5cl.i386.rpm Conectiva Upgrade openssl-progs-0.9.6c-2U80_5cl.i386.rpm ftp://atualizacoes.conectiva.com.br/8/RPMS/openssl-progs-0.9.6c-2U80_5cl.i386.rpm OpenSSL Project OpenSSL 0.9.6 b: OpenSSL Project Upgrade openssl-0.9.6j.tar.gz http://www.openssl.org/source/openssl-0.9.6j.tar.gz OpenSSL Project OpenSSL 0.9.6 a: Conectiva Upgrade openssl-devel-static-0.9.6a-3U70_6cl.i386.rpm ftp://atualizacoes.conectiva.com.br/7.0/RPMS/openssl-devel-static-0.9.6a-3U70_6cl.i386.rpm Conectiva Upgrade openssl-doc-0.9.6a-3U70_6cl.i386.rpm ftp://atualizacoes.conectiva.com.br/7.0/RPMS/openssl-doc-0.9.6a-3U70_6cl.i386.rpm Conectiva Upgrade openssl-progs-0.9.6a-3U70_6cl.i386.rpm ftp://atualizacoes.conectiva.com.br/7.0/RPMS/openssl-progs-0.9.6a-3U70_6cl.i386.rpm OpenSSL Project Upgrade openssl-0.9.6j.tar.gz http://www.openssl.org/source/openssl-0.9.6j.tar.gz Conectiva Upgrade openssl-0.9.6a-3U70_6cl.i386.rpm ftp://atualizacoes.conectiva.com.br/7.0/RPMS/openssl-0.9.6a-3U70_6cl.i386.rpm Conectiva Upgrade openssl-devel-0.9.6a-3U70_6cl.i386.rpm ftp://atualizacoes.conectiva.com.br/7.0/RPMS/openssl-devel-0.9.6a-3U70_6cl.i386.rpm OpenSSL Project OpenSSL 0.9.6: EnGarde Secure Linux Upgrade openssl-0.9.6-1.0.19.i386.rpm ftp://ftp.engardelinux.org/pub/engarde/stable/updates/i386/openssl-0.9.6-1.0.19.i386.rpm EnGarde Secure Linux Upgrade openssl-0.9.6-1.0.19.i686.rpm ftp://ftp.engardelinux.org/pub/engarde/stable/updates/i686/openssl-0.9.6-1.0.19.i686.rpm EnGarde Secure Linux Upgrade openssl-misc-0.9.6-1.0.19.i386.rpm ftp://ftp.engardelinux.org/pub/engarde/stable/updates/i386/openssl-misc-0.9.6-1.0.19.i386.rpm EnGarde Secure Linux Upgrade openssl-misc-0.9.6-1.0.19.i686.rpm ftp://ftp.engardelinux.org/pub/engarde/stable/updates/i686/openssl-misc-0.9.6-1.0.19.i686.rpm SCO Patch openssl-0.9.6-21.i386.rpm ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2003-014.0/RPMS/openssl-0.9.6-21.i386.rpm SCO Patch openssl-0.9.6-21.i386.rpm ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2003-014.0/RPMS/openssl-0.9.6-21.i386.rpm SCO Patch openssl-0.9.6-21.i386.rpm ftp://ftp.sco.com/pub/updates/OpenLinux/3.1/Server/CSSA-2003-014.0/RPMS/openssl-0.9.6-21.i386.rpm SCO Patch openssl-0.9.6-21.i386.rpm ftp://ftp.sco.com/pub/updates/OpenLinux/3.1/Workstation/CSSA-2003-014.0/RPMS/openssl-0.9.6-21.i386.rpm SCO Patch openssl-devel-0.9.6-21.i386.rpm ftp://ftp.sco.com/pub/updates/OpenLinux/3.1/Workstation/CSSA-2003-014.0/RPMS/openssl-devel-0.9.6-21.i386.rpm SCO Patch openssl-devel-0.9.6-21.i386.rpm ftp://ftp.sco.com/pub/updates/OpenLinux/3.1/Server/CSSA-2003-014.0/RPMS/openssl-devel-0.9.6-21.i386.rpm SCO Patch openssl-devel-0.9.6-21.i386.rpm ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2003-014.0/RPMS/openssl-devel-0.9.6-21.i386.rpm SCO Patch openssl-devel-0.9.6-21.i386.rpm ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2003-014.0/RPMS/openssl-devel-0.9.6-21.i386.rpm SCO Patch openssl-devel-static-0.9.6-21.i386.rpm ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2003-014.0/RPMS/openssl-devel-static-0.9.6-21.i386.rpm SCO Patch openssl-devel-static-0.9.6-21.i386.rpm ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2003-014.0/RPMS/openssl-devel-static-0.9.6-21.i386.rpm SCO Patch openssl-devel-static-0.9.6-21.i386.rpm ftp://ftp.sco.com/pub/updates/OpenLinux/3.1/Server/CSSA-2003-014.0/RPMS/openssl-devel-static-0.9.6-21.i386.rpm SCO Patch openssl-devel-static-0.9.6-21.i386.rpm ftp://ftp.sco.com/pub/updates/OpenLinux/3.1/Workstation/CSSA-2003-014.0/RPMS/openssl-devel-static-0.9.6-21.i386.rpm OpenSSL Project Upgrade openssl-0.9.6j.tar.gz http://www.openssl.org/source/openssl-0.9.6j.tar.gz Conectiva Upgrade openssl-0.9.6-4U60_6cl.i386.rpm ftp://atualizacoes.conectiva.com.br/6.0/RPMS/openssl-0.9.6-4U60_6cl.i386.rpm Conectiva Upgrade openssl-devel-0.9.6-4U60_6cl.i386.rpm ftp://atualizacoes.conectiva.com.br/6.0/RPMS/openssl-devel-0.9.6-4U60_6cl.i386.rpm Trustix Secure Linux Upgrade openssl-0.9.6-13tr.i586.rpm ftp://ftp.trustix.net/pub/Trustix/updates/1.1/RPMS/openssl-0.9.6-13tr.i586.rpm Trustix Secure Linux Upgrade openssl-0.9.6-13tr.i586.rpm ftp://ftp.trustix.net/pub/Trustix/updates/1.2/RPMS/openssl-0.9.6-13tr.i586.rpm Trustix Secure Linux Upgrade openssl-0.9.6-13tr.i586.rpm ftp://ftp.trustix.net/pub/Trustix/updates/1.5/RPMS/openssl-0.9.6-13tr.i586.rpm Trustix Secure Linux Upgrade openssl-0.9.6-13tr.src.rpm ftp://ftp.trustix.net/pub/Trustix/updates/1.1/SRPMS/openssl-0.9.6-13tr.src.rpm Trustix Secure Linux Upgrade openssl-0.9.6-13tr.src.rpm ftp://ftp.trustix.net/pub/Trustix/updates/1.2/SRPMS/openssl-0.9.6-13tr.src.rpm Trustix Secure Linux Upgrade openssl-0.9.6-13tr.src.rpm ftp://ftp.trustix.net/pub/Trustix/updates/1.5/SRPMS/openssl-0.9.6-13tr.src.rpm Trustix Secure Linux Upgrade openssl-devel-0.9.6-13tr.i586.rpm ftp://ftp.trustix.net/pub/Trustix/updates/1.5/RPMS/openssl-devel-0.9.6-13tr.i586.rpm Trustix Secure Linux Upgrade openssl-devel-0.9.6-13tr.i586.rpm ftp://ftp.trustix.net/pub/Trustix/updates/1.2/RPMS/openssl-devel-0.9.6-13tr.i586.rpm Trustix Secure Linux Upgrade openssl-devel-0.9.6-13tr.i586.rpm ftp://ftp.trustix.net/pub/Trustix/updates/1.1/RPMS/openssl-devel-0.9.6-13tr.i586.rpm Trustix Secure Linux Upgrade openssl-python-0.9.6-13tr.i586.rpm ftp://ftp.trustix.net/pub/Trustix/updates/1.1/RPMS/openssl-python-0.9.6-13tr.i586.rpm Trustix Secure Linux Upgrade openssl-python-0.9.6-13tr.i586.rpm ftp://ftp.trustix.net/pub/Trustix/updates/1.2/RPMS/openssl-python-0.9.6-13tr.i586.rpm Trustix Secure Linux Upgrade openssl-python-0.9.6-13tr.i586.rpm ftp://ftp.trustix.net/pub/Trustix/updates/1.5/RPMS/openssl-python-0.9.6-13tr.i586.rpm Trustix Secure Linux Upgrade openssl-support-0.9.6-13tr.i586.rpm ftp://ftp.trustix.net/pub/Trustix/updates/1.5/RPMS/openssl-support-0.9.6-13tr.i586.rpm Trustix Secure Linux Upgrade openssl-support-0.9.6-13tr.i586.rpm ftp://ftp.trustix.net/pub/Trustix/updates/1.2/RPMS/openssl-support-0.9.6-13tr.i586.rpm Trustix Secure Linux Upgrade openssl-support-0.9.6-13tr.i586.rpm ftp://ftp.trustix.net/pub/Trustix/updates/1.1/RPMS/openssl-support-0.9.6-13tr.i586.rpm OpenSSL Project OpenSSL 0.9.7 a: Mandrake Patch libopenssl0.9.7-0.9.7a-1.1mdk.i586.rpm http://www.mandrakesecure.net/en/ftp.php Mandrake Linux 9.1 Mandrake Patch libopenssl0.9.7-0.9.7a-1.1mdk.ppc.rpm http://www.mandrakesecure.net/en/ftp.php Mandrake Linux 9.1/PPC Mandrake Patch libopenssl0.9.7-devel-0.9.7a-1.1mdk.i586.rpm http://www.mandrakesecure.net/en/ftp.php Mandrake Linux 9.1 Mandrake Patch libopenssl0.9.7-devel-0.9.7a-1.1mdk.ppc.rpm http://www.mandrakesecure.net/en/ftp.php Mandrake Linux 9.1/PPC Mandrake Patch libopenssl0.9.7-static-devel-0.9.7a-1.1mdk.i586.rpm http://www.mandrakesecure.net/en/ftp.php Mandrake Linux 9.1 Mandrake Patch libopenssl0.9.7-static-devel-0.9.7a-1.1mdk.ppc.rpm http://www.mandrakesecure.net/en/ftp.php Mandrake Linux 9.1/PPC Mandrake Patch openssl-0.9.7a-1.1mdk.i586.rpm http://www.mandrakesecure.net/en/ftp.php Mandrake Linux 9.1 Mandrake Patch openssl-0.9.7a-1.1mdk.ppc.rpm http://www.mandrakesecure.net/en/ftp.php Mandrake Linux 9.1/PPC OpenSSL Project Upgrade openssl-0.9.7b.tar.gz http://www.openssl.org/source/openssl-0.9.7b.tar.gz OpenSSL Project OpenSSL 0.9.7: OpenPKG Upgrade openssl-0.9.7-1.2.2.src.rpm ftp://ftp.openpkg.org/release/1.2/UPD/openssl-0.9.7-1.2.2.src.rpm OpenPKG 1.2 OpenSSL Project Upgrade openssl-0.9.7b.tar.gz http://www.openssl.org/source/openssl-0.9.7b.tar.gz Stunnel Stunnel 3.20: Stunnel Patch blinding-3.x_bri.patch http://www.stunnel.org/patches/desc/blinding-3.x_bri.html Stunnel Stunnel 3.10: Stunnel Patch blinding-3.x_bri.patch http://www.stunnel.org/patches/desc/blinding-3.x_bri.html Stunnel Stunnel 3.7: Stunnel Patch blinding-3.x_bri.patch http://www.stunnel.org/patches/desc/blinding-3.x_bri.html Stunnel Stunnel 3.8: Stunnel Patch blinding-3.x_bri.patch http://www.stunnel.org/patches/desc/blinding-3.x_bri.html Stunnel Stunnel 3.9: Stunnel Patch blinding-3.x_bri.patch http://www.stunnel.org/patches/desc/blinding-3.x_bri.html Stunnel Stunnel 3.11: Stunnel Patch blinding-3.x_bri.patch http://www.stunnel.org/patches/desc/blinding-3.x_bri.html Stunnel Stunnel 3.12: Stunnel Patch blinding-3.x_bri.patch http://www.stunnel.org/patches/desc/blinding-3.x_bri.html Stunnel Stunnel 3.13: Stunnel Patch blinding-3.x_bri.patch http://www.stunnel.org/patches/desc/blinding-3.x_bri.html Stunnel Stunnel 3.14: Stunnel Patch blinding-3.x_bri.patch http://www.stunnel.org/patches/desc/blinding-3.x_bri.html Stunnel Stunnel 3.15: Stunnel Patch blinding-3.x_bri.patch http://www.stunnel.org/patches/desc/blinding-3.x_bri.html Stunnel Stunnel 3.16: Stunnel Patch blinding-3.x_bri.patch http://www.stunnel.org/patches/desc/blinding-3.x_bri.html Stunnel Stunnel 3.17: Stunnel Patch blinding-3.x_bri.patch http://www.stunnel.org/patches/desc/blinding-3.x_bri.html Stunnel Stunnel 3.18: Stunnel Patch blinding-3.x_bri.patch http://www.stunnel.org/patches/desc/blinding-3.x_bri.html Stunnel Stunnel 3.19: Stunnel Patch blinding-3.x_bri.patch http://www.stunnel.org/patches/desc/blinding-3.x_bri.html Stunnel Stunnel 3.21: Stunnel Patch blinding-3.x_bri.patch http://www.stunnel.org/patches/desc/blinding-3.x_bri.html Stunnel Stunnel 3.22: Stunnel Patch blinding-3.x_bri.patch http://www.stunnel.org/patches/desc/blinding-3.x_bri.html Stunnel Stunnel 4.0 4: Stunnel Patch blinding-4.x_bri.patch http://www.stunnel.org/patches/desc/blinding-4.x_bri.html Stunnel Stunnel 4.0 3: Stunnel Patch blinding-4.x_bri.patch http://www.stunnel.org/patches/desc/blinding-4.x_bri.html Stunnel Stunnel 4.0 2: Stunnel Patch blinding-4.x_bri.patch http://www.stunnel.org/patches/desc/blinding-4.x_bri.html Stunnel Stunnel 4.0 1: Stunnel Patch blinding-4.x_bri.patch http://www.stunnel.org/patches/desc/blinding-4.x_bri.html Stunnel Stunnel 4.0: Stunnel Patch blinding-4.x_bri.patch http://www.stunnel.org/patches/desc/blinding-4.x_bri.html 相关信息 David Brumley and Dan Boneh 参考：http://www.securityfocus.com/advisories/5176 http://www.securityfocus.com/advisories/5136 http://www.securityfocus.com/advisories/5163 http://www.securityfocus.com/advisories/5274 http://www.securityfocus.com/advisor |
