|
|
|
Stunnel Information for VU#104280
| Date Notified | 09/30/2003 |
| Date Modified | 08/25/2004 01:54:06 PM |
| Status Summary | Vulnerable |
Vendor StatementStunnel requires the OpenSSL libraries for compilation (POSIX) or OpenSSL DLLs for runtime operation (Windows). While Stunnel itself is not vulnerable, it's dependence on OpenSSL means that your installation likely is vulnerable.
If you compile from source, you need to install a non-vulnerable version of OpenSSL and recompile Stunnel.
If you use the compiled Windows DLLs from stunnel.org, you should download new versions which are not vulnerable. OpenSSL 0.9.7c DLLs are available at http://www.stunnel.org/download/stunnel/win32/openssl-0.9.7c/
No new version of Stunnel source or executable will be made available, because the problems are inside OpenSSL -- Stunnel itself does not have the vulnerability.AddendumThe CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us
email.
|
 |
