Re: freetds have some ssl security problems

Do you have any reference code for GnuTLS and/or OpenSSL ?

Frediano

Frediano

2014-10-24 12:07 GMT+01:00 何博远 <[email protected]>:

> IMO, for self-signed certificate, it's still necessary to do verification.
> For example, the client certificate in MS SQLserver is signed by a root
> certificate in server. User can also configure there own root certificate
> for SQLserver in order to secure the SSL connection. So I agree that there
> should be locations of root certificate in the clients and also there
> should at least an option for certificate verification, otherwise SSL is
> pointless.‍
>
>
> Thanks.
> Roca
> ------------------ Original ------------------
> From:  "Frediano Ziglio";<[email protected]>;
> Date:  Fri, Oct 24, 2014 00:12 AM
> To:  "FreeTDS Development Group"<[email protected]>;
>
> Subject:  Re: [freetds] freetds have some ssl security problems
>
>
>
> 2014-10-23 16:06 GMT+01:00 Frediano Ziglio <[email protected]>:
> > 2014-10-23 15:14 GMT+01:00 润青杨 <[email protected]>:
> >> Hi guys,
> >> Recently, our group are trying to find ssl security problems by static
> >> anlysis. Now we have find some problems in freetds-bin and report this
> bugs
> >> to the launchpad, but we haven't receive any responses.
> >> Could you please take a look at this bug:
> >> https://bugs.launchpad.net/ubuntu/+source/freetds/+bug/1376592
> >> Thanks,
> >> Rainkin
> >
> >
> > Thank you,
> >   I think you are right.
> >
> > However there is mainly a problem in the default configuration. By
> > default when you install a server it use quite silently a self-signed.
> > This means mainly that a man in the middle is just behind the door.
> >
> > Frediano
>
> Yes, there should be some option. Specifically we should test
> everything having some options to disable some checks. Also location
> for root certificate should be required.
>
> Frediano
> _______________________________________________
> FreeTDS mailing list
> [email protected]
> http://lists.ibiblio.org/mailman/listinfo/freetds
> _______________________________________________
> FreeTDS mailing list
> [email protected]
> http://lists.ibiblio.org/mailman/listinfo/freetds
>
_______________________________________________
FreeTDS mailing list
[email protected]
http://lists.ibiblio.org/mailman/listinfo/freetds