Security fixes for tmda-ofmipd now available

I've pushed two commits out to the Subversion repository as well as my
GitHub fork. On GitHub I've also tagged a new release (tag name
tmda-1.1.12-kg3 or debian-tmda-1.1.12-kg3-1 for the branch that
includes Debian packaging) and uploaded new .deb packages:

https://github.com/KevinGoodsell/tmda-fork

As indicated in the subject line, these changes are to address issues
that I consider security problems for tmda-ofmipd. Two separate issues
are addressed with these changes:

First, tmda-ofmipd allowed the use of SSL version 2, which is an
older, insecure version of the protocol. It also allowed weak 40-bit
and 56-bit ciphers. In all cases these were allowed because that is
the default for the OpenSSL library. One of the changes adds a new
--ciphers option to tmda-ofmipd, which allows the user to control
which ciphersuites are accepted by the server. The default set
excludes weak ciphers and SSL version 2 ciphers (though any user who
really needs to can easily re-enable them).

Second, tmda-ofmipd's error handling broke badly when SSL clients
disconnected abruptly. This resulted in the process entering a tight,
infinite loop and fixing the CPU usage at 100%, producing what could
be considered a denial of service attack. There's also some indication
that the server could be shut down remotely under some error
conditions (this is not verified). The error handling has been
significantly improved now, and tested against rapid-fire
connects/disconnects, SSL protocol negotiation failures, and nmap
scans.

These issues probably aren't much more than a nuisance to most users,
but I encourage any user of tmda-ofmipd (or the tmda-smtp Debian
package) to upgrade.

I will be turning my attention for a while to improving some of the
tests for tmda-ofmipd, which I found to be lacking during the testing
for this release. Following that I expect to return to tmda-cgi to do
some cleanup work in preparation for the next official release.

-Kevin

------------------------------------------------------------------------------
Xperia(TM) PLAY
It's a major breakthrough. An authentic gaming
smartphone on the nation's most reliable network.
And it wants your games.
http://p.sf.net/sfu/verizon-sfdev
_______________________________________________
tmda-workers mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tmda-workers