Re: freetds have some ssl security problems

IMO, for self-signed certificate, it's still necessary to do verification. For example, the client certificate in MS SQLserver is signed by a root certificate in server. User can also configure there own root certificate  for SQLserver in order to secure the SSL connection. So I agree that there should be locations of root certificate in the clients and also there should at least an option for certificate verification, otherwise SSL is pointless.‍


Thanks.
Roca
------------------ Original ------------------
From:  "Frediano Ziglio";<[email protected]>;
Date:  Fri, Oct 24, 2014 00:12 AM
To:  "FreeTDS Development Group"<[email protected]>; 

Subject:  Re: [freetds] freetds have some ssl security problems



2014-10-23 16:06 GMT+01:00 Frediano Ziglio <[email protected]>:
> 2014-10-23 15:14 GMT+01:00 润青杨 <[email protected]>:
>> Hi guys,
>> Recently, our group are trying to find ssl security problems by static
>> anlysis. Now we have find some problems in freetds-bin and report this bugs
>> to the launchpad, but we haven't receive any responses.
>> Could you please take a look at this bug:
>> https://bugs.launchpad.net/ubuntu/+source/freetds/+bug/1376592
>> Thanks,
>> Rainkin
>
>
> Thank you,
>   I think you are right.
>
> However there is mainly a problem in the default configuration. By
> default when you install a server it use quite silently a self-signed.
> This means mainly that a man in the middle is just behind the door.
>
> Frediano

Yes, there should be some option. Specifically we should test
everything having some options to disable some checks. Also location
for root certificate should be required.

Frediano
_______________________________________________
FreeTDS mailing list
[email protected]
http://lists.ibiblio.org/mailman/listinfo/freetds
_______________________________________________
FreeTDS mailing list
[email protected]
http://lists.ibiblio.org/mailman/listinfo/freetds