Stunnel Information for VU#104280
Multiple vulnerabilities in SSL/TLS implementations
- Vendor Information Help Date Notified: 30 Sep 2003
- Statement Date:
- Date Updated: 01 Oct 2003
Stunnel requires the OpenSSL libraries for compilation (POSIX) or OpenSSL DLLs for runtime operation (Windows). While Stunnel itself is not vulnerable, it's dependence on OpenSSL means that your installation likely is vulnerable.
If you compile from source, you need to install a non-vulnerable version of OpenSSL and recompile Stunnel.
If you use the compiled Windows DLLs from stunnel.org, you should download new versions which are not vulnerable. OpenSSL 0.9.7c DLLs are available at http://www.stunnel.org/download/stunnel/win32/openssl-0.9.7c/
No new version of Stunnel source or executable will be made available, because the problems are inside OpenSSL -- Stunnel itself does not have the vulnerability.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.