Re: freetds have some ssl security problems

2014-10-23 16:06 GMT+01:00 Frediano Ziglio <[email protected]>:
> 2014-10-23 15:14 GMT+01:00 润青杨 <[email protected]>:
>> Hi guys,
>> Recently, our group are trying to find ssl security problems by static
>> anlysis. Now we have find some problems in freetds-bin and report this bugs
>> to the launchpad, but we haven't receive any responses.
>> Could you please take a look at this bug:
>> https://bugs.launchpad.net/ubuntu/+source/freetds/+bug/1376592
>> Thanks,
>> Rainkin
>
>
> Thank you,
>   I think you are right.
>
> However there is mainly a problem in the default configuration. By
> default when you install a server it use quite silently a self-signed.
> This means mainly that a man in the middle is just behind the door.
>
> Frediano

Yes, there should be some option. Specifically we should test
everything having some options to disable some checks. Also location
for root certificate should be required.

Frediano
_______________________________________________
FreeTDS mailing list
[email protected]
http://lists.ibiblio.org/mailman/listinfo/freetds