DOCSLIB.ORG

Open Source Used in Asyncos 13.0 for Cisco Email Security Appliances

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Open Source Used in Asyncos 13.0 for Cisco Email Security Appliances Open Source Used In AsyncOS 13.0 for Cisco Email Security Appliances Cisco Systems, Inc. www.cisco.com Cisco has more than 200 offices worldwide. Addresses, phone numbers, and fax numbers are listed on the Cisco website at www.cisco.com/go/offices. Text Part Number: 78EE117C99-197242486 Open Source Used In AsyncOS 13.0 for Cisco Email Security Appliances 1 This document contains licenses and notices for open source software used in this product. With respect to the free/open source software listed in this document, if you have any questions or wish to receive a copy of any source code to which you may be entitled under the applicable free/open source license(s) (such as the GNU Lesser/General Public License), please contact us at [email protected]. In your requests please include the following reference number 78EE117C99-197242486 Contents 1.1 AnyEvent 7.05 1.1.1 Available under license 1.2 Apache Commons Lang 2.0 1.2.1 Notifications 1.2.2 Available under license 1.3 Apache Commons: Logging 1.0.3 1.3.1 Notifications 1.3.2 Available under license 1.4 Aquarium 2.2.1 1.4.1 Available under license 1.5 Archive::Zip 1.30 1.5.1 Available under license 1.6 B::Deobfuscate 0.20 1.6.1 Available under license 1.7 B::Deobfuscate 0.10 1.7.1 Available under license 1.8 B::Keywords 1.10 1.8.1 Available under license 1.9 B::Keywords 0.06 1.9.1 Available under license 1.10 bash 4.4.12 1.10.1 Available under license 1.11 BerkeleyDB-perl 0.49 1.11.1 Available under license 1.12 boto3 1.9.125 1.12.1 Available under license Open Source Used In AsyncOS 13.0 for Cisco Email Security Appliances 2 1.13 Bouncy Castle 1.34 1.13.1 Available under license 1.14 Bouncy Castle 1.5 1.14.1 Available under license 1.15 BSD::Resource 1.2904 1.15.1 Available under license 1.16 BSD::Resource 1.2903 1.16.1 Available under license 1.17 cabby 0.1.20 1.17.1 Available under license 1.18 cheetah 1 1.18.1 Available under license 1.19 Codec 1.2 1.19.1 Notifications 1.19.2 Available under license 1.20 common::sense 3.4 1.20.1 Available under license 1.21 Commons Collections 3.2.1 1.21.1 Available under license 1.22 Commons Collections 3.2.1 1.22.1 Available under license 1.23 commons-beanutils (DUPLICATE) 1.6.1 1.23.1 Notifications 1.23.2 Available under license 1.24 commons-beanutils (DUPLICATE) 1.6.1 1.24.1 Available under license 1.25 Compress::Raw::Bzip2 2.037 1.25.1 Available under license 1.26 Compress::Raw::Zlib 2.037 1.26.1 Available under license 1.27 Compress::Zlib 1.33 1.27.1 Available under license 1.28 Convert::Bencode_XS 1.03 1.28.1 Available under license 1.29 Convert::Bencode_XS 0.06 1.29.1 Available under license 1.30 curl 7.31.0 1.30.1 Available under license 1.31 curl 7.55.1 :1ubuntu2.4 Open Source Used In AsyncOS 13.0 for Cisco Email Security Appliances 3 1.31.1 Available under license 1.32 dcc 1.2.58 1.32.1 Available under license 1.33 Digest::HMAC 1.01 1.33.1 Available under license 1.34 Digest::SHA1 2.10 1.34.1 Available under license 1.35 exchangelib 1.12.1 1.35.1 Available under license 1.36 Expat 2.2.1 1.36.1 Available under license 1.37 ffs2recov 1.0 1.38 file 5.29 1.38.1 Available under license 1.39 File::LibMagic 1.84 1.39.1 Available under license 1.40 File::Sync 0.09 1.40.1 Available under license 1.41 fpconst 0.7.2 1.41.1 Available under license 1.42 fpdf 1.7.2 1.42.1 Available under license 1.43 FreeBSD Kernel 10.4 1.43.1 Available under license 1.44 fuzzywuzzy 0.10.0 1.44.1 Available under license 1.45 Getopt::ArgvFile 1.11 1.45.1 Available under license 1.46 gettext 0.19.8.1 :2 1.46.1 Available under license 1.47 glib2 2.36.3 :5.el7 1.47.1 Available under license 1.48 HTML::Parser 3.64 1.48.1 Available under license 1.49 HTML::Tagset 3.20 1.49.1 Available under license 1.50 HttpClient 3.0.1 1.50.1 Available under license 1.51 indexinfo 0.2.6 Open Source Used In AsyncOS 13.0 for Cisco Email Security Appliances 4 1.51.1 Available under license 1.52 IO::Compress 2.037 1.52.1 Available under license 1.53 IO::String 1.06 1.53.1 Available under license 1.54 IPMItool 1.8.9 1.54.1 Available under license 1.55 jansson 2.5 1.55.1 Available under license 1.56 java-getopt 1.0.9 1.56.1 Available under license 1.57 json-c 0.13 1.57.1 Available under license 1.58 json-c 0.12 1.58.1 Available under license 1.59 jzlib 1.0.7 1.59.1 Available under license 1.60 langdetect 1.0.5 1.60.1 Available under license 1.61 Lasso 2.5.1 1.61.1 Available under license 1.62 libarchive 3.3.1-r1 1.62.1 Available under license 1.63 libarchive 3.3.1 :1 1.63.1 Available under license 1.64 libev 4.03 1.64.1 Available under license 1.65 libevent2 2.0.21 :2.el6 1.65.1 Available under license 1.66 libexecinfo 1.1 :3 1.66.1 Available under license 1.67 libffi 3.2.1 :4 1.67.1 Available under license 1.68 libgcrypt 1.8.0 1.68.1 Available under license 1.69 libgpg-error0 1.27 :r0.0 1.69.1 Available under license 1.70 libiconv 1.14_10 1.70.1 Available under license Open Source Used In AsyncOS 13.0 for Cisco Email Security Appliances 5 1.71 libidn 1.33 1.71.1 Available under license 1.72 libpng 1.2.35 1.72.1 Available under license 1.73 libtool 2.4.6 1.73.1 Available under license 1.74 libwww 5.4.0 :3.0.2.0903352 1.74.1 Available under license 1.75 libxslt 1.1.29 1.75.1 Available under license 1.76 Log4j 1.2.6 1.76.1 Notifications 1.76.2 Available under license 1.77 lsof 4.90 1.78 lsof 4.71 1.78.1 Notifications 1.78.2 Available under license 1.79 lucene-core 6.2.1 1.79.1 Available under license 1.80 lzo 2.10 1.80.1 Available under license 1.81 ncurses 6.0 :3 1.81.1 Available under license 1.82 net-snmp 5.7.1 1.82.1 Available under license 1.83 Net::DNS 0.48 1.83.1 Available under license 1.84 NetAddr::IP 4.024 1.84.1 Available under license 1.85 nginx 1.12.1 1.85.1 Available under license 1.86 nss 3.32 1.86.1 Available under license 1.87 One-JAR 0.96 1.87.1 Available under license 1.88 openldap 2.3.43 1.88.1 Available under license 1.89 openldap 2.4.40 :(2014/09/20) 1.89.1 Available under license Open Source Used In AsyncOS 13.0 for Cisco Email Security Appliances 6 1.90 openldap/nss-pam-ldapd 2.4.40 1.90.1 Available under license 1.91 OpenSSH 7.3p1 1.91.1 Available under license 1.92 OpenSSL 1.0.2m 1.92.1 Notifications 1.92.2 Available under license 1.93 OpenSSL patch to 0.9.8 branch to add RFC5649 (key wrap with pad) 1.0 1.93.1 Notifications 1.93.2 Available under license 1.94 org.ibex.crypto 2010-10-10 1.94.1 Available under license 1.95 org.ibex.io 2010-10-10 1.95.1 Available under license 1.96 org.ibex.net 2010-10-10 1.96.1 Available under license 1.97 org.ibex.util 2010-10-10 1.97.1 Available under license 1.98 PAR 1.002 1.98.1 Available under license 1.99 PAR::Packer 1.008 1.99.1 Available under license 1.100 PCRE 8.40 1.100.1 Available under license 1.101 Perl 5.8.9 1.101.1 Available under license 1.102 Perl 5.24 1.102.1 Available under license 1.103 perl-Frontier-RPC 0.07b4p1 :9.el6 1.103.1 Available under license 1.104 pkgconf 1.3.7 1.104.1 Available under license 1.105 postgresql 9.2.22 1.105.1 Available under license 1.106 protobuf 2.2.0 1.106.1 Available under license 1.107 PyJWT 1.5.3 1.107.1 Available under license 1.108 python 2.6.4 Open Source Used In AsyncOS 13.0 for Cisco Email Security Appliances 7 1.108.1 Available under license 1.109 python-Levenshtein 0.12.0 1.109.1 Available under license 1.110 python2-stix 1.2.0.4 1.110.1 Available under license 1.111 PyXML 0.8.2 1.111.1 Available under license 1.112 regexp 1.1 1.112.1 Notifications 1.112.2 Available under license 1.113 regexp 1.1 1.113.1 Notifications 1.113.2 Available under license 1.114 ReportLab 2.4 1.114.1 Available under license 1.115 requests 2.9.1 1.115.1 Available under license 1.116 rsa 3.3 1.116.1 Available under license 1.117 SHA1 0.1 1.117.1 Available under license 1.118 simplejson 2.0.9 1.118.1 Available under license 1.119 Sleepycat 4.4.20 1.119.1 Available under license 1.120 smartmontools 6.5 1.120.1 Available under license 1.121 SOAPpy 0.12.0 1.121.1 Available under license 1.122 srm 1.2.15 1.122.1 Available under license 1.123 SSL_dane 1.0 1.124 stunnel 5.03 5.03 1.124.1 Available under license 1.125 sudo 1.7.4p4 1.125.1 Available under license 1.126 sudo_BSD 1.7.4p4 1.126.1 Available under license 1.127 swig 3.0.12 Open Source Used In AsyncOS 13.0 for Cisco Email Security Appliances 8 1.127.1 Available under license 1.128 tagsoup 1.2.1 1.128.1 Available under license 1.129 timeout-decorator 0.4.1 1.130 TinySSL 1.03 1.130.1 Available under license 1.131 tzdata 2017b-1 1.131.1 Available under license 1.132 udns 0.4 1.132.1 Available under license 1.133 unbound 1.7.0 1.133.1 Available under license 1.134 unbound 1.8.1 1.134.1 Available under license 1.135 URI 1.37 1.135.1 Available under license 1.136 velocity 1.5 1.136.1 Available under license 1.137 version 0.78 1.137.1 Available under license 1.138 YAML 0.35 1.138.1 Available under license 1.139 YUI 2.8.0 1.139.1 Available under license 1.1 AnyEvent 7.05 1.1.1 Available under license : This module is licensed under the same terms as perl itself.
Load more

Recommended publications
  • Not-Quite-So-Broken TLS Lessons in Re-Engineering a Security Protocol Specification and Implementation
    Not-quite-so-broken TLS Lessons in re-engineering a security protocol specification and implementation David Kaloper Meršinjak Hannes Mehnert Peter Sewell Anil Madhavapeddy University of Cambridge, Computer Labs Usenix Security, Washington DC, 12 August 2015 INT SSL23_GET_CLIENT_HELLO(SSL *S) { CHAR BUF_SPACE[11]; /* REQUEST THIS MANY BYTES IN INITIAL READ. * WE CAN DETECT SSL 3.0/TLS 1.0 CLIENT HELLOS * ('TYPE == 3') CORRECTLY ONLY WHEN THE FOLLOWING * IS IN A SINGLE RECORD, WHICH IS NOT GUARANTEED BY * THE PROTOCOL SPECIFICATION: * BYTE CONTENT * 0 TYPE \ * 1/2 VERSION > RECORD HEADER * 3/4 LENGTH / * 5 MSG_TYPE \ * 6-8 LENGTH > CLIENT HELLO MESSAGE Common CVE sources in 2014 Class # Memory safety 15 State-machine errors 10 Certificate validation 5 ASN.1 parsing 3 (OpenSSL, GnuTLS, SecureTransport, Secure Channel, NSS, JSSE) Root causes Error-prone languages Lack of separation Ambiguous and untestable specification nqsb approach Choice of language and idioms Separation and modular structure A precise and testable specification of TLS Reuse between specification and implementation Choice of language and idioms OCaml: a memory-safe language with expressive static type system Well contained side-effects Explicit flows of data Value-based Explicit error handling We leverage it for abstraction and automated resource management. Formal approaches Either reason about a simplified model of the protocol; or reason about small parts of OpenSSL. In contrast, we are engineering a deployable implementation. nqsb-tls A TLS stack, developed from scratch, with dual goals: Executable specification Usable TLS implementation Structure nqsb-TLS ML module layout Core Is purely functional: VAL HANDLE_TLS : STATE -> BUFFER -> [ `OK OF STATE * BUFFER OPTION * BUFFER OPTION | `FAIL OF FAILURE ] Core OCaml helps to enforce state-machine invariants.
    [Show full text]
  • Building Online Content and Community with Drupal
    Collaborative Librarianship Volume 1 Issue 4 Article 10 2009 Building Online Content and Community with Drupal Gabrielle Wiersma University of Colorado at Boulder, [email protected] Follow this and additional works at: https://digitalcommons.du.edu/collaborativelibrarianship Part of the Collection Development and Management Commons Recommended Citation Wiersma, Gabrielle (2009) "Building Online Content and Community with Drupal," Collaborative Librarianship: Vol. 1 : Iss. 4 , Article 10. DOI: https://doi.org/10.29087/2009.1.4.10 Available at: https://digitalcommons.du.edu/collaborativelibrarianship/vol1/iss4/10 This Review is brought to you for free and open access by Digital Commons @ DU. It has been accepted for inclusion in Collaborative Librarianship by an authorized editor of Digital Commons @ DU. For more information, please contact [email protected],[email protected]. Wiersma: Building Online Content and Community with Drupal Building Online Content and Community with Drupal Gabrielle Wiersma ([email protected]) Engineering Research and Instruction Librarian, University of Colorado at Boulder Libraries use content management systems Additionally, all users are allowed to post in order to create, manage, edit, and publish content without using code, which enables content on the Web more efficiently. Drupal less tech savvy users to contribute content (drupal.org), one such Web-based content just as easily as their more proficient coun- management system, is unique because it terparts. For example, a library could use employs a bottom-up strategy for Web de- Drupal to allow library staff to view and sign that separates the content of the site edit the library Web site, blog, and staff from the formatting which means that “you intranet.
    [Show full text]
  • Arxiv:1911.09312V2 [Cs.CR] 12 Dec 2019
    Revisiting and Evaluating Software Side-channel Vulnerabilities and Countermeasures in Cryptographic Applications Tianwei Zhang Jun Jiang Yinqian Zhang Nanyang Technological University Two Sigma Investments, LP The Ohio State University [email protected] [email protected] [email protected] Abstract—We systematize software side-channel attacks with three questions: (1) What are the common and distinct a focus on vulnerabilities and countermeasures in the cryp- features of various vulnerabilities? (2) What are common tographic implementations. Particularly, we survey past re- mitigation strategies? (3) What is the status quo of cryp- search literature to categorize vulnerable implementations, tographic applications regarding side-channel vulnerabili- and identify common strategies to eliminate them. We then ties? Past work only surveyed attack techniques and media evaluate popular libraries and applications, quantitatively [20–31], without offering unified summaries for software measuring and comparing the vulnerability severity, re- vulnerabilities and countermeasures that are more useful. sponse time and coverage. Based on these characterizations This paper provides a comprehensive characterization and evaluations, we offer some insights for side-channel of side-channel vulnerabilities and countermeasures, as researchers, cryptographic software developers and users. well as evaluations of cryptographic applications related We hope our study can inspire the side-channel research to side-channel attacks. We present this study in three di- community to discover new vulnerabilities, and more im- rections. (1) Systematization of literature: we characterize portantly, to fortify applications against them. the vulnerabilities from past work with regard to the im- plementations; for each vulnerability, we describe the root cause and the technique required to launch a successful 1.
    [Show full text]
  • Understanding Code Forking in Open Source Software
    EKONOMI OCH SAMHÄLLE ECONOMICS AND SOCIETY LINUS NYMAN – UNDERSTANDING CODE FORKING IN OPEN SOURCE SOFTWARE SOURCE OPEN IN FORKING CODE UNDERSTANDING – NYMAN LINUS UNDERSTANDING CODE FORKING IN OPEN SOURCE SOFTWARE AN EXAMINATION OF CODE FORKING, ITS EFFECT ON OPEN SOURCE SOFTWARE, AND HOW IT IS VIEWED AND PRACTICED BY DEVELOPERS LINUS NYMAN Ekonomi och samhälle Economics and Society Skrifter utgivna vid Svenska handelshögskolan Publications of the Hanken School of Economics Nr 287 Linus Nyman Understanding Code Forking in Open Source Software An examination of code forking, its effect on open source software, and how it is viewed and practiced by developers Helsinki 2015 < Understanding Code Forking in Open Source Software: An examination of code forking, its effect on open source software, and how it is viewed and practiced by developers Key words: Code forking, fork, open source software, free software © Hanken School of Economics & Linus Nyman, 2015 Linus Nyman Hanken School of Economics Information Systems Science, Department of Management and Organisation P.O.Box 479, 00101 Helsinki, Finland Hanken School of Economics ISBN 978-952-232-274-6 (printed) ISBN 978-952-232-275-3 (PDF) ISSN-L 0424-7256 ISSN 0424-7256 (printed) ISSN 2242-699X (PDF) Edita Prima Ltd, Helsinki 2015 i ACKNOWLEDGEMENTS There are many people who either helped make this book possible, or at the very least much more enjoyable to write. Firstly I would like to thank my pre-examiners Imed Hammouda and Björn Lundell for their insightful suggestions and remarks. Furthermore, I am grateful to Imed for also serving as my opponent. I would also like to express my sincere gratitude to Liikesivistysrahasto, the Hanken Foundation, the Wallenberg Foundation, and the Finnish Unix User Group.
    [Show full text]
  • FOSS Philosophy 6 the FOSS Development Method 7
    1 Published by the United Nations Development Programme’s Asia-Pacific Development Information Programme (UNDP-APDIP) Kuala Lumpur, Malaysia www.apdip.net Email: [email protected] © UNDP-APDIP 2004 The material in this book may be reproduced, republished and incorporated into further works provided acknowledgement is given to UNDP-APDIP. For full details on the license governing this publication, please see the relevant Annex. ISBN: 983-3094-00-7 Design, layout and cover illustrations by: Rezonanze www.rezonanze.com PREFACE 6 INTRODUCTION 6 What is Free/Open Source Software? 6 The FOSS philosophy 6 The FOSS development method 7 What is the history of FOSS? 8 A Brief History of Free/Open Source Software Movement 8 WHY FOSS? 10 Is FOSS free? 10 How large are the savings from FOSS? 10 Direct Cost Savings - An Example 11 What are the benefits of using FOSS? 12 Security 13 Reliability/Stability 14 Open standards and vendor independence 14 Reduced reliance on imports 15 Developing local software capacity 15 Piracy, IPR, and the WTO 16 Localization 16 What are the shortcomings of FOSS? 17 Lack of business applications 17 Interoperability with proprietary systems 17 Documentation and “polish” 18 FOSS SUCCESS STORIES 19 What are governments doing with FOSS? 19 Europe 19 Americas 20 Brazil 21 Asia Pacific 22 Other Regions 24 What are some successful FOSS projects? 25 BIND (DNS Server) 25 Apache (Web Server) 25 Sendmail (Email Server) 25 OpenSSH (Secure Network Administration Tool) 26 Open Office (Office Productivity Suite) 26 LINUX 27 What is Linux?
    [Show full text]
  • Not-Quite-So-Broken TLS: Lessons in Re-Engineering a Security Protocol Specification and Implementation
    Not-Quite-So-Broken TLS: Lessons in Re-Engineering a Security Protocol Specification and Implementation David Kaloper-Meršinjak, Hannes Mehnert, Anil Madhavapeddy, and Peter Sewell, University of Cambridge https://www.usenix.org/conference/usenixsecurity15/technical-sessions/presentation/kaloper-mersinjak This paper is included in the Proceedings of the 24th USENIX Security Symposium August 12–14, 2015 • Washington, D.C. ISBN 978-1-939133-11-3 Open access to the Proceedings of the 24th USENIX Security Symposium is sponsored by USENIX Not-quite-so-broken TLS: lessons in re-engineering a security protocol specification and implementation David Kaloper-Mersinjakˇ †, Hannes Mehnert†, Anil Madhavapeddy and Peter Sewell University of Cambridge Computer Laboratory [email protected] † These authors contributed equally to this work Abstract sensitive services, they are not providing the security we need. Transport Layer Security (TLS) is the most widely Transport Layer Security (TLS) implementations have a deployed security protocol on the Internet, used for au- history of security flaws. The immediate causes of these thentication and confidentiality, but a long history of ex- are often programming errors, e.g. in memory manage- ploits shows that its implementations have failed to guar- ment, but the root causes are more fundamental: the chal- antee either property. Analysis of these exploits typically lenges of interpreting the ambiguous prose specification, focusses on their immediate causes, e.g. errors in mem- the complexities inherent in large APIs and code bases, ory management or control flow, but we believe their root inherently unsafe programming choices, and the impos- causes are more fundamental: sibility of directly testing conformance between imple- mentations and the specification.
    [Show full text]
  • A Technical Comparison of Ipsec and SSL
    A Technical Comparison of IPSec and SSL y Ab delNasir Alshamsi Takamichi Saito Tokyo University of Technology Abstract p osed but the most famous secure and widely de ployed are IPSec IP Security and SSL Secure So cket Layer IPSec IP Security and SSL SecureSocket Layer In this pap er we will provide a technical comparison have been the most robust and most potential tools of IPSec and SSL the similarities and the dierences available for securing communications over the Inter of the cryptographic prop erties The results of per net Both IPSec and SSL have advantages and short formance are based on comparing FreeSWAN as comings Yet no paper has been found comparing the IPSec and Stunnel as SSL two protocols in terms of characteristic and functional ity Our objective is to present an analysis of security and performancepr operties for IPSec and SSL IPSec IPSec is an IP layer proto col that enables the Intro duction sending and receiving of cryptographically protected packets of any kind TCPUDPICMPetc without any provides two kinds of crypto mo dication IPSec Securing data over the network is hard and compli graphic services Based on necessity IPSec can provide cated issue while the threat of data mo dication and condentiality and authenticity or it can provide data interruption is rising The goal of network security authenticity only is to provide condentiality integrity and authenticity Condentiality is keeping the data secret from the ESP Encapsulated SecurityPayload unintended listeners on the network Integrity is en suring
    [Show full text]
  • Secure Channels Secure Channels • Example Applications – PGP: Pretty Good Privacy CS 161/194-1 – TLS: Transport Layer Security Anthony D
    Main Points • Applying last week’s lectures in practice • Creating Secure Channels Secure Channels • Example Applications – PGP: Pretty Good Privacy CS 161/194-1 – TLS: Transport Layer Security Anthony D. Joseph – VPN: Virtual Private Network September 26, 2005 September 26, 2005 CS161 Fall 2005 2 Joseph/Tygar/Vazirani/Wagner What is a Secure Channel? Plaintext Plaintext Creating Secure Channels Encryption / Internet Encryption / • Authentication and Data Integrity Decryption Decryption Ciphertext and MAC – Use Public Key Infrastructure or third-party server to authenticate each end to the other • A stream with these security requirements: – Add Message Authentication Code for – Authentication integrity • Ensures sender and receiver are who they claim to be – Confidentiality • Confidentiality • Ensures that data is read only by authorized users – Data integrity – Exchange session key for encrypt/decrypt ops • Ensures that data is not changed from source to destination • Bulk data transfer – Non-repudiation (not discussed today) • Ensures that sender can’t deny message and rcvr can’t deny msg • Key Distribution and Segmentation September 26, 2005 CS161 Fall 2005 3 September 26, 2005 CS161 Fall 2005 4 Joseph/Tygar/Vazirani/Wagner Joseph/Tygar/Vazirani/Wagner Symmetric Key-based Symmetric Key-based Secure Channel Secure Channel Alice Bob • Sender (A) and receiver (B) share secret keys KABencrypt KABencrypt – One key for A è B confidentiality KABauth KABauth – One for A è B authentication/integrity Message MAC Compare? Message – Each message
    [Show full text]
  • Plaintext-Recovery Attacks Against Datagram TLS
    Plaintext-Recovery Attacks Against Datagram TLS Nadhem J. AlFardan and Kenneth G. Paterson∗ Information Security Group Royal Holloway, University of London, Egham, Surrey TW20 0EX, UK fNadhem.Alfardan.2009, [email protected] Abstract GnuTLS2. Both of these provide source toolkits that imple- ment TLS and DTLS as well as being general purpose cryp- The Datagram Transport Layer Security (DTLS) proto- tographic libraries that software developers can use. The col provides confidentiality and integrity of data exchanged first release of OpenSSL to implement DTLS was 0.9.8. between a client and a server. We describe an efficient and Since its release, DTLS has become a mainstream proto- full plaintext recovery attack against the OpenSSL imple- col in OpenSSL. There are also a number of commercial mentation of DTLS, and a partial plaintext recovery attack products that have taken advantage of DTLS. For example, against the GnuTLS implementation of DTLS. The attack DTLS is used to secure Virtual Private Networks (VPNs)3;4 against the OpenSSL implementation is a variant of Vaude- and wireless traffic5. Platforms such as Microsoft Windows, nay’s padding oracle attack and exploits small timing differ- Microsoft .NET and Linux can also make use of DTLS6. ences arising during the cryptographic processing of DTLS In addition, the number of RFC documents that are be- packets. It would have been prevented if the OpenSSL im- ing published on DTLS is increasing. Recent examples in- plementation had been in accordance with the DTLS RFC. clude RFC 5415 [1], RFC 5953 [8] and RFC 6012 [13]. A In contrast, the GnuTLS implementation does follow the new version of DTLS is currently under development in the DTLS RFC closely, but is still vulnerable to attack.
    [Show full text]
  • Elements of Free and Open Source Licenses: Features That Define Strategy
    Elements Of Free And Open Source Licenses: Features That Define Strategy CAN: Use/reproduce: Ability to use, copy / reproduce the work freely in unlimited quantities Distribute: Ability to distribute the work to third parties freely, in unlimited quantities Modify/merge: Ability to modify / combine the work with others and create derivatives Sublicense: Ability to license the work, including possible modifications (without changing the license if it is copyleft or share alike) Commercial use: Ability to make use of the work for commercial purpose or to license it for a fee Use patents: Rights to practice patent claims of the software owner and of the contributors to the code, in so far these rights are necessary to make full use of the software Place warranty: Ability to place additional warranty, services or rights on the software licensed (without holding the software owner and other contributors liable for it) MUST: Incl. Copyright: Describes whether the original copyright and attribution marks must be retained Royalty free: In case a fee (i.e. contribution, lump sum) is requested from recipients, it cannot be royalties (depending on the use) State changes: Source code modifications (author, why, beginning, end) must be documented Disclose source: The source code must be publicly available Copyleft/Share alike: In case of (re-) distribution of the work or its derivatives, the same license must be used/granted: no re-licensing. Lesser copyleft: While the work itself is copyleft, derivatives produced by the normal use of the work are not and could be covered by any other license SaaS/network: Distribution includes providing access to the work (to its functionalities) through a network, online, from the cloud, as a service Include license: Include the full text of the license in the modified software.
    [Show full text]
  • Prying Open Pandora's Box: KCI Attacks Against
    Prying open Pandora’s box: KCI attacks against TLS Clemens Hlauschek, Markus Gruber, Florian Fankhauser, Christian Schanes RISE – Research Industrial Systems Engineering GmbH {clemens.hlauschek, markus.gruber, florian.fankhauser, christian.schanes}@rise-world.com Abstract and implementations of the protocol: their utility is ex- tremely limited, their raison d’ˆetre is practically nil, and Protection of Internet communication is becoming more the existence of these insecure key agreement options common in many products, as the demand for privacy only adds to the arsenal of attack vectors against cryp- in an age of state-level adversaries and crime syndi- tographically secured communication on the Internet. cates is steadily increasing. The industry standard for doing this is TLS. The TLS protocol supports a multi- 1 Introduction tude of key agreement and authentication options which provide various different security guarantees. Recent at- The TLS protocol [1, 2, 3] is probably the most tacks showed that this plethora of cryptographic options widely used cryptographic protocol on the Internet. in TLS (including long forgotten government backdoors, It is designed to secure the communication between which have been cunningly inserted via export restric- client/server applications against eavesdropping, tamper- tion laws) is a Pandora’s box, waiting to be pried open by ing, and message forgery, and it also provides additional, heinous computer whizzes. Novel attacks lay hidden in optional security properties such as client authentica- plainsight. Parts of TLS areso oldthat theirfoul smell of tion. TLS is an historically grown giant: its predecessor, rot cannot be easily distinguished from the flowery smell SSL [4,5], was developed more than 20 years ago.
    [Show full text]
  • Plaintext-Recovery Attacks Against Datagram TLS
    Plaintext-Recovery Attacks Against Datagram TLS Nadhem J. AlFardan and Kenneth G. Paterson∗ Information Security Group Royal Holloway, University of London, Egham, Surrey TW20 0EX, UK nadhem.alfardan.2009, kenny.paterson @rhul.ac.uk { } Abstract GnuTLS2. Both of these provide source toolkits that imple- ment TLS and DTLS as well as being general purpose cryp- The Datagram Transport Layer Security (DTLS) proto- tographic libraries that software developers can use. The col provides confidentiality and integrity of data exchanged first release of OpenSSL to implement DTLS was 0.9.8. between a client and a server. We describe an efficient and Since its release, DTLS has become a mainstream proto- full plaintext recovery attack against the OpenSSL imple- col in OpenSSL. There are also a number of commercial mentation of DTLS, and a partial plaintext recovery attack products that have taken advantage of DTLS. For example, against the GnuTLS implementation of DTLS. The attack DTLS is used to secure Virtual Private Networks (VPNs)3,4 against the OpenSSL implementation is a variant of Vaude- and wireless traffic5. Platforms such as Microsoft Windows, nay’s padding oracle attack and exploits small timing differ- Microsoft .NET and Linux can also make use of DTLS6. ences arising during the cryptographic processing of DTLS In addition, the number of RFC documents that are be- packets. It would have been prevented if the OpenSSL im- ing published on DTLS is increasing. Recent examples in- plementation had been in accordance with the DTLS RFC. clude RFC 5415 [1], RFC 5953 [8] and RFC 6012 [13]. A In contrast, the GnuTLS implementation does follow the new version of DTLS is currently under development in the DTLS RFC closely, but is still vulnerable to attack.
    [Show full text]