DOCSLIB.ORG

Cisco Telepresence Server 4.3 Open Source Documentation

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Cisco Telepresence Server 4.3 Open Source Documentation Open Source Used In Cisco TelePresence Server 4.3 Cisco Systems, Inc. www.cisco.com Cisco has more than 200 offices worldwide. Addresses, phone numbers, and fax numbers are listed on the Cisco website at www.cisco.com/go/offices. Text Part Number: 78EE117C99-67603929 Open Source Used In Cisco TelePresence Server 4.3 1 This document contains licenses and notices for open source software used in this product. With respect to the free/open source software listed in this document, if you have any questions or wish to receive a copy of any source code to which you may be entitled under the applicable free/open source license(s) (such as the GNU Lesser/General Public License), please contact us at [email protected]. In your requests please include the following reference number 78EE117C99-67603929 Contents 1.1 Brian Gladman's AES Implementation 11-01-11 1.1.1 Available under license 1.2 BusyBox 1.5.1 :busybox 1.2.1 Available under license 1.3 Coreboot d9b5d897d7f05d0ee8f9411628b757beea990b4b 1.3.1 Available under license 1.4 curl and libcurl 7.44.0 :7.44.0 1.4.1 Available under license 1.5 dhcp 4.1.1-P1 1.5.1 Available under license 1.6 expat 2.1.0 1.6.1 Available under license 1.7 FatFS R0.05 1.7.1 Available under license 1.8 freetype 2.5.3 1.8.1 Available under license 1.9 fribidi 0.19.6 :1 1.9.1 Available under license 1.10 G.722 2.00 1.10.1 Available under license 1.11 HMAC n/a 1.11.1 Available under license 1.12 icelib f50dffe9820bb7e32ac7b9b1b1d19aa3431227a2 1.12.1 Available under license 1.13 lal-libpng 1.6.10 1.13.1 Available under license Open Source Used In Cisco TelePresence Server 4.3 2 1.14 lal-npm-mime 1.2.11 1.14.1 Available under license 1.15 ldns 1.6.16 :2012-11-13 1.15.1 Available under license 1.16 libarchive 3.1.2 libarchive 3.1.2 1.16.1 Available under license 1.17 libbz2 1.0.5 :34.246 1.17.1 Available under license 1.18 libexecinfo-1.1 libexecinfo-1.1 1.18.1 Available under license 1.19 libjpeg 6b 1.19.1 Notifications 1.19.2 Available under license 1.20 libunwind 1.1 1.20.1 Available under license 1.21 linux 3.4.86 1.21.1 Available under license 1.22 Lua 5.2.2 1.22.1 Available under license 1.23 lua 5.1.2 1.23.1 Available under license 1.24 lwIP 1.4.0 :rc1 1.24.1 Available under license 1.25 nanopb 0.2.6 1.25.1 Available under license 1.26 nat-tools f50dffe9820bb7e32ac7b9b1b1d19aa3431227a2 1.26.1 Available under license 1.27 net-snmp 5.4.1 1.27.1 Available under license 1.28 newlib 1.17.0 1.28.1 Available under license 1.29 newlib/newlib-proper-except-linuxthreads 1.17.0 1.29.1 Available under license 1.30 node 2014.09.16, Version 0.10.32 (Stable) 1.30.1 Available under license 1.31 node/deps/http_parser 2014.09.16, Version 0.10.32 (Stable) 1.31.1 Available under license 1.32 node/deps/npm/node_modules/block-stream 2014.09.16, Version 0.10.32 (Stable) Open Source Used In Cisco TelePresence Server 4.3 3 1.32.1 Available under license 1.33 node/deps/npm/node_modules/chownr 2014.09.16, Version 0.10.32 (Stable) 1.33.1 Available under license 1.34 node/deps/npm/node_modules/npmconf/node_modules/config-chain 2014.09.16, Version 0.10.32 (Stable) 1.34.1 Available under license 1.35 node/deps/npm/node_modules/read 2014.09.16, Version 0.10.32 (Stable) 1.35.1 Available under license 1.36 node/deps/npm/node_modules/tar 2014.09.16, Version 0.10.32 (Stable) 1.36.1 Available under license 1.37 node/deps/openssl/openssl 2014.09.16, Version 0.10.32 (Stable) 1.37.1 Notifications 1.37.2 Available under license 1.38 node/deps/uv 2014.09.16, Version 0.10.32 (Stable) 1.38.1 Available under license 1.39 node/deps/v8 2014.09.16, Version 0.10.32 (Stable) 1.39.1 Available under license 1.40 node/deps/zlib 2014.09.16, Version 0.10.32 (Stable) 1.40.1 Available under license 1.41 npm-buffer-crc32 0.2.1 1.41.1 Available under license 1.42 npm-cookie 0.1.0 1.42.1 Available under license 1.43 npm-cookie-signature 1.0.3 1.43.1 Available under license 1.44 npm-debug 0.8.1 1.44.1 Available under license 1.45 npm-escape-html 1.0.1 1.45.1 Available under license 1.46 npm-express 4.0.0 1.46.1 Available under license 1.47 npm-fresh 0.2.2 1.47.1 Available under license 1.48 npm-merge-descriptors 0.0.2 1.48.1 Available under license 1.49 npm-methods 0.1.0 1.49.1 Available under license 1.50 npm-negotiator 0.3.0 1.50.1 Available under license Open Source Used In Cisco TelePresence Server 4.3 4 1.51 npm-node-slip 0.0.2 1.51.1 Available under license 1.52 npm-qs 0.6.6 1.52.1 Available under license 1.53 npm-range-parser 1.0.0 1.53.1 Available under license 1.54 npm-regexp 0.1.2 1.54.1 Available under license 1.55 npm-send 0.2.0 1.55.1 Available under license 1.56 npm-serve-static 1.0.1 1.56.1 Available under license 1.57 npm-type-is 1.0.0 1.57.1 Available under license 1.58 npm-utils-merge 1.0.0 1.58.1 Available under license 1.59 openssl 1.0.2f 1.59.1 Notifications 1.59.2 Available under license 1.60 OpenSSL patch to 0.9.8 branch to add RFC5649 (key wrap with pad) 1.0 1.60.1 Notifications 1.60.2 Available under license 1.61 picoOS 1.0.0 1.61.1 Available under license 1.62 Prototype 1.6.0.2. 1.62.1 Available under license 1.63 scriptaculous 1.8.1 1.63.1 Available under license 1.64 seabios 1.7.2.1 1.64.1 Available under license 1.65 sha1 01/08/2005 1.65.1 Available under license 1.66 sockaddrutil f50dffe9820bb7e32ac7b9b1b1d19aa3431227a2 1.66.1 Available under license 1.67 src/common/net/lwip 1.4.1 1.67.1 Available under license 1.68 stunlib f50dffe9820bb7e32ac7b9b1b1d19aa3431227a2 1.68.1 Available under license 1.69 unbound 1.4.10 Open Source Used In Cisco TelePresence Server 4.3 5 1.69.1 Available under license 1.70 usbd 0.1.2 1.70.1 Available under license 1.71 yajl 2.1.0 1.71.1 Available under license 1.72 zlib 1.2.8 1.72.1 Available under license FreeBSD 8.4 Vauxhall 2.1 beadm 1.2.2 2.1.1 Available under license 2.2 freebsd-bind9 9.8.4 2.2.1 Available under license 2.3 freebsd-src 8.4 2.3.1 Available under license 2.4 src-cddl 8.4 2.4.1 Available under license 2.5 src-nocopyleft 8.4 2.5.1 Available under license 2.6 src-sys-cddl 8.4 2.6.1 Available under license 2.7 src/contrib/amd 6.1.5 2.7.1 Available under license 2.8 src/contrib/cvs 8.4 2.8.1 Available under license 2.9 src/contrib/file 8.4 2.9.1 Available under license 2.10 src/contrib/gcclibs/libiberty 8.4 2.10.1 Available under license 2.11 src/contrib/gdb 8.4 2.11.1 Available under license 2.12 src/contrib/gdb/gdb 8.4 2.12.1 Available under license 2.13 src/contrib/gdb/include 8.4 2.13.1 Available under license 2.14 src/contrib/gnu-sort 8.4 2.14.1 Available under license 2.15 src/contrib/gperf 8.4 2.15.1 Available under license Open Source Used In Cisco TelePresence Server 4.3 6 2.16 src/contrib/groff 8.4 2.16.1 Available under license 2.17 src/contrib/libf2c/libU77 8.4 2.17.1 Available under license 2.18 src/contrib/libreadline 8.4 2.18.1 Available under license 2.19 src/contrib/lukemftp 8.4 2.19.1 Available under license 2.20 src/contrib/lukemftpd 8.4 2.20.1 Available under license 2.21 src/contrib/ntp 4.2.4p5 2.21.1 Available under license 2.22 src/contrib/ntp/arlib 4.2.4p5 2.22.1 Available under license 2.23 src/contrib/ntp/libopts 4.2.4p5 2.23.1 Available under license 2.24 src/contrib/ntp/sntp 4.2.4p5 2.24.1 Available under license 2.25 src/contrib/ntp/sntp/libopts 4.2.4p5 2.25.1 Available under license 2.26 src/contrib/one-true-awk 20121220 2.26.1 Available under license 2.27 src/contrib/opie 8.4 2.27.1 Available under license 2.28 src/contrib/pam_modules/pam_passwdqc 8.4 2.28.1 Available under license 2.29 src/contrib/sendmail 8.4 2.29.1 Available under license 2.30 src/contrib/smbfs 8.4 2.30.1 Available under license 2.31 src/contrib/texinfo 8.4 2.31.1 Available under license 2.32 src/contrib/wpa 8.4 2.32.1 Available under license 2.33 src/crypto/openssh 8.4 2.33.1 Available under license 2.34 src/crypto/openssl 8.4 2.34.1 Available under license 2.35 src/crypto/openssl/crypto/bf 8.4 Open Source Used In Cisco TelePresence Server 4.3 7 2.35.1 Available under license 2.36 src/crypto/openssl/crypto/des 8.4 2.36.1 Available under license 2.37 src/gnu 8.4 2.37.1 Available under license 2.38 src/gnu/lib/libdialog 8.4 2.38.1 Available under license 2.39 src/gnu/usr.bin/dialog 8.4 2.39.1 Available under license 2.40 src/gnu/usr.bin/man 8.4 2.40.1 Available under license 2.41 src/gnu/usr.bin/send-pr 8.4 2.41.1 Available under license 2.42 src/lib/libc/regex alpha3.4 2.42.1 Available under license 2.43 src/lib/libc/rpc 8.4 2.43.1 Available under license 2.44 src/lib/libcompat/regexp 8.4 2.44.1 Available under license 2.45 src/sys/contrib/dev/mwl 8.4 2.45.1 Available under license 2.46 src/sys/contrib/dev/npe 8.4 2.46.1 Available under license 2.47 src/sys/contrib/dev/ral 8.4 2.47.1 Available under license 2.48 src/sys/contrib/dev/run 8.4 2.48.1 Available under license 2.49 src/sys/contrib/dev/wpi 8.4 2.49.1 Available under license 2.50 src/sys/dev/e1000 8.4 2.50.1 Available under license 2.51 src/sys/dev/ixgb 8.4 2.51.1 Available under license 2.52 src/sys/dev/ixgbe 8.4 2.52.1 Available under license 2.53 src/sys/netatalk 8.4 2.53.1 Available under license 2.54 src/sys/xen/interface 8.4 2.54.1 Available under license Open Source Used In Cisco TelePresence Server 4.3 8 2.55 src/tools/regression/fstest 8.4 2.55.1 Available under license 2.56 src/tools/regression/mac/mac_portacl 8.4 2.56.1 Available under license 2.57 src/tools/regression/zfs 8.4 2.57.1 Available under license 2.58 src/usr.bin/lex 8.4 2.58.1 Available under license 2.59 src/usr.sbin/crunch 8.4 2.59.1 Available under license 1.1 Brian Gladman's AES Implementation 11- 01-11 1.1.1 Available under license : /* --------------------------------------------------------------------------- Copyright (c) 1998-2008, Brian Gladman, Worcester, UK.
Load more

  1049
Copy Link
Recommended publications
  • Secure Socket Layer (SSL) Transport Layer Security (TLS)
    Secure Socket Layer (SSL) Transport Layer Security (TLS) © André Zúquete Advanced Network Security TLS (Transport Layer Security, RFC 5246): Goals w Secure communication protocol over TCP/IP ® Standard inspired by SSL V3 (Secure Sockets Layer) ® Handles secure sessions per application over TCP/IP • Initially conceived for HTTP traffic • Currently being used by other kinds of traffic w Security mechanisms ® TCP payload protection • Confidentiality • Stream integrity ® Key distribution ® Peer authentication • Server authentication (the normal scenario) • Client authentication • Usually a person • Not usually explored © André Zúquete Advanced Network Security 1 Change Handshake Alert IMAP, Cipher Protocol Protocol HTTP Spec. etc. IMAP, TLS/SSL: HTTP etc. Protocols Record Protocol w Handshake Protocol TCP ® Key distribution • Master secrets (48 bytes) • Computed with DH; or • Chose by the client, upload to the server encrypted with the server’s public key • Session keys • Computed from a master secret and two nonces exchanged ® Peer authentication • Asymmetric encryption with long-term or ephemeral keys • Public key certificates for long-term public keys w Record Protocol ® Handling of secure data records ® Compression, confidentiality, integrity control © André Zúquete Advanced Network Security TLS/SSL versions w SSL ® 1.0 ® 2.0: 1995, prohibited by RFC 6176 (2011) ® 3.0: 1996, RFC 6101 (2011), deprecated by RFC 7568 (2015) w TLS ® 1.0: 1999: RFC 2246 SSL BEAST (2011) ® 1.1: 2006: RFC 4346 ® 1.2: 2008: RFC 5246 ® 1.3: 2018: RFC 8446 © André
    [Show full text]
  • ROADS and BRIDGES: the UNSEEN LABOR BEHIND OUR DIGITAL INFRASTRUCTURE Preface
    Roads and Bridges:The Unseen Labor Behind Our Digital Infrastructure WRITTEN BY Nadia Eghbal 2 Open up your phone. Your social media, your news, your medical records, your bank: they are all using free and public code. Contents 3 Table of Contents 4 Preface 58 Challenges Facing Digital Infrastructure 5 Foreword 59 Open source’s complicated relationship with money 8 Executive Summary 66 Why digital infrastructure support 11 Introduction problems are accelerating 77 The hidden costs of ignoring infrastructure 18 History and Background of Digital Infrastructure 89 Sustaining Digital Infrastructure 19 How software gets built 90 Business models for digital infrastructure 23 How not charging for software transformed society 97 Finding a sponsor or donor for an infrastructure project 29 A brief history of free and public software and the people who made it 106 Why is it so hard to fund these projects? 109 Institutional efforts to support digital infrastructure 37 How The Current System Works 38 What is digital infrastructure, and how 124 Opportunities Ahead does it get built? 125 Developing effective support strategies 46 How are digital infrastructure projects managed and supported? 127 Priming the landscape 136 The crossroads we face 53 Why do people keep contributing to these projects, when they’re not getting paid for it? 139 Appendix 140 Glossary 142 Acknowledgements ROADS AND BRIDGES: THE UNSEEN LABOR BEHIND OUR DIGITAL INFRASTRUCTURE Preface Our modern society—everything from hospitals to stock markets to newspapers to social media—runs on software. But take a closer look, and you’ll find that the tools we use to build software are buckling under demand.
    [Show full text]
  • Libressl Presentatie2
    Birth of LibreSSL and its current status Frank Timmers Consutant, Snow B.V. Background What is LibreSSL • A fork of OpenSSL 1.0.1g • Being worked on extensively by a number of OpenBSD developers What is OpenSSL • OpenSSL is an open source SSL/TLS crypto library • Currently the de facto standard for many servers and clients • Used for securing http, smtp, imap and many others Alternatives • Netscape Security Services (NSS) • BoringSSL • GnuTLS What is Heartbleed • Heartbleed was a bug leaking of private data (keys) from both client and server • At this moment known as “the worst bug ever” • Heartbeat code for DTLS over UDP • So why was this also included in the TCP code? • Not the reason to create a fork Why did this happen • Nobody looked • Or at least didn’t admit they looked Why did nobody look • The code is horrible • Those who did look, quickly looked away and hoped upstream could deal with it Why was the code so horrible • Buggy re-implementations of standard libc functions like random() and malloc() • Forces all platforms to use these buggy implementations • Nested #ifdef, #ifndefs (up to 17 layers deep) through out the code • Written in “OpenSSL C”, basically their own dialect • Everything on by default Why was it so horrible? crypto_malloc • Never frees memory (Tools like Valgrind, Coverity can’t spot bugs) • Used LIFO recycling (Use after free?) • Included debug malloc by default, logging private data • Included the ability to replace malloc/free at runtime #ifdef trees • #ifdef, #elif, #else trees up to 17 layers deep • Throughout the complete source • Some of which could never be reached • Hard to see what is or not compiled in 1.
    [Show full text]
  • Vxworks Third Party Software Notices
    Wind River® VxWorks® 7 Third Party License Notices This document contains third party intellectual property (IP) notices for the BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY Wind River® VxWorks® 7 distribution. Certain licenses and license notices THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, may appear in other parts of the product distribution in accordance with the OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN license requirements. ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. Trademarks All company, product and service names used in this software are for ACPICA identification purposes only. Version: 20170303 Component(s): Runtime Wind River and VxWorks are registered trademarks of Wind River Systems. Description: Provides code to implement ACPI specification in VxWorks. UNIX is a registered trademark of The Open Group. IBM and Bluemix are registered trademarks of the IBM Corporation. NOTICES: All other third-party trademarks are the property of their respective owners. 1. Copyright Notice Some or all of this work - Copyright (c) 1999 - 2016, Intel Corp. All rights reserved. Third Party Notices 2. License 2.1. This is your license from Intel Corp. under its intellectual property rights. You may have additional license terms from the party that provided you this software, covering your right to use that party's intellectual property rights. 64-Bit Dynamic Linker Version: 2.2. Intel grants, free of charge, to any person ("Licensee") obtaining a copy Component(s): Runtime of the source code appearing in this file ("Covered Code") an irrevocable, Description: The dynamic linker is used to load shared libraries.
    [Show full text]
  • Mac OS X Server Administrator's Guide
    034-9285.S4AdminPDF 6/27/02 2:07 PM Page 1 Mac OS X Server Administrator’s Guide K Apple Computer, Inc. © 2002 Apple Computer, Inc. All rights reserved. Under the copyright laws, this publication may not be copied, in whole or in part, without the written consent of Apple. The Apple logo is a trademark of Apple Computer, Inc., registered in the U.S. and other countries. Use of the “keyboard” Apple logo (Option-Shift-K) for commercial purposes without the prior written consent of Apple may constitute trademark infringement and unfair competition in violation of federal and state laws. Apple, the Apple logo, AppleScript, AppleShare, AppleTalk, ColorSync, FireWire, Keychain, Mac, Macintosh, Power Macintosh, QuickTime, Sherlock, and WebObjects are trademarks of Apple Computer, Inc., registered in the U.S. and other countries. AirPort, Extensions Manager, Finder, iMac, and Power Mac are trademarks of Apple Computer, Inc. Adobe and PostScript are trademarks of Adobe Systems Incorporated. Java and all Java-based trademarks and logos are trademarks or registered trademarks of Sun Microsystems, Inc. in the U.S. and other countries. Netscape Navigator is a trademark of Netscape Communications Corporation. RealAudio is a trademark of Progressive Networks, Inc. © 1995–2001 The Apache Group. All rights reserved. UNIX is a registered trademark in the United States and other countries, licensed exclusively through X/Open Company, Ltd. 062-9285/7-26-02 LL9285.Book Page 3 Tuesday, June 25, 2002 3:59 PM Contents Preface How to Use This Guide 39 What’s Included
    [Show full text]
  • Open Source Documentation Used in WAP4410N, Version 2.0.5.X
    Open Source Used In WAP4410N 2.0.5.x This document contains the licenses and notices for open source software used in this product. With respect to the free/open source software listed in this document, if you have any questions or wish to receive a copy of the source code to which you are entitled under the applicable free/open source license(s) (such as the GNU Lesser/General Public License) , please contact us at http://www.cisco.com/go/smallbiz_opensource_request. In your requests please include the following reference number 78EE117C99-24342489 En ce qui a trait au logiciel gratuit ou à exploitation libre figurant dans ce document, si vous avez des questions ou souhaitez recevoir une copie du code source, auquel vous avez droit en vertu des licences gratuites ou d'exploitation libre applicables (telles que licences GNU Lesser/General Public), veuillez communiquer avec nous à l'adresse http://www.cisco.com/go/smallbiz_opensource_request. Dans vos demandes, veuillez inclure le numéro de référence 78EE117C99-24342489 Contents 1.1 ag7100 1.0 1.1.1 Available under license 1.2 binutils 2.16.1 1.2.1 Available under license 1.3 busybox 1.1.0 1.3.1 Available under license 1.4 ccache 2.4 78-20798-01 Open Source Used In WAP4410N 2.0.5.x 1 1.4.1 Available under license 1.5 dhcp 0.1 1.5.1 Available under license 1.6 gcc 3.4.4 1.6.1 Available under license 1.7 genext2fs 1.3 1.7.1 Available under license 1.8 hostapd 0.5.9 1.8.1 Available under license 1.9 libiconv 1.8 1.9.1 Available under license 1.10 libupnp 1.2.1 1.10.1 Available under license
    [Show full text]
  • Post-Quantum Authentication in Openssl with Hash-Based Signatures
    Recalling Hash-Based Signatures Motivations for Cryptographic Library Integration Cryptographic Libraries OpenSSL & open-quantum-safe XMSS Certificate Signing in OpenSSL / open-quantum-safe Conclusions Post-Quantum Authentication in OpenSSL with Hash-Based Signatures Denis Butin, Julian Wälde, and Johannes Buchmann TU Darmstadt, Germany 1 / 26 I Quantum computers are not available yet, but deployment of new crypto takes time, so transition must start now I Well established post-quantum signature schemes: hash-based cryptography (XMSS and variants) I Our goal: make post-quantum signatures available in a popular security software library: OpenSSL Recalling Hash-Based Signatures Motivations for Cryptographic Library Integration Cryptographic Libraries OpenSSL & open-quantum-safe XMSS Certificate Signing in OpenSSL / open-quantum-safe Conclusions Overall Motivation I Networking requires authentication; authentication is realized by cryptographic signature schemes I Shor’s algorithm (1994): most public-key cryptography (RSA, DSA, ECDSA) breaks once large quantum computers exist I Post-quantum cryptography: public-key algorithms thought to be secure against quantum computer attacks 2 / 26 Recalling Hash-Based Signatures Motivations for Cryptographic Library Integration Cryptographic Libraries OpenSSL & open-quantum-safe XMSS Certificate Signing in OpenSSL / open-quantum-safe Conclusions Overall Motivation I Networking requires authentication; authentication is realized by cryptographic signature schemes I Shor’s algorithm (1994): most public-key
    [Show full text]
  • Black-Box Security Analysis of State Machine Implementations Joeri De Ruiter
    Black-box security analysis of state machine implementations Joeri de Ruiter 18-03-2019 Agenda 1. Why are state machines interesting? 2. How do we know that the state machine is implemented correctly? 3. What can go wrong if the implementation is incorrect? What are state machines? • Almost every protocol includes some kind of state • State machine is a model of the different states and the transitions between them • When receiving a messages, given the current state: • Decide what action to perform • Which message to respond with • Which state to go the next Why are state machines interesting? • State machines play a very important role in security protocols • For example: • Is the user authenticated? • Did we agree on keys? And if so, which keys? • Are we encrypting our traffic? • Every implementation of a protocol has to include the corresponding state machine • Mistakes can lead to serious security issues! State machine example Confirm transaction Verify PIN 0000 Failed Init Failed Verify PIN 1234 OK Verified Confirm transaction OK State machines in specifications • Often specifications do not explicitly contain a state machine • Mainly explained in lots of prose • Focus usually on happy flow • What to do if protocol flow deviates from this? Client Server ClientHello --------> ServerHello Certificate* ServerKeyExchange* CertificateRequest* <-------- ServerHelloDone Certificate* ClientKeyExchange CertificateVerify* [ChangeCipherSpec] Finished --------> [ChangeCipherSpec] <-------- Finished Application Data <-------> Application Data
    [Show full text]
  • Vetting SSL Usage in Applications with SSLINT
    2015 IEEE Symposium on Security and Privacy Vetting SSL Usage in Applications with SSLINT Boyuan He1, Vaibhav Rastogi2, Yinzhi Cao3, Yan Chen2, V.N. Venkatakrishnan4, Runqing Yang1, and Zhenrui Zhang1 1Zhejiang University 2Northwestern University 3Columbia University 4University of Illinois, Chicago [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] Abstract—Secure Sockets Layer (SSL) and Transport Layer In particular, we ask the following research question: Is it Security (TLS) protocols have become the security backbone of possible to design scalable techniques that detect incorrect use the Web and Internet today. Many systems including mobile of APIs in applications using SSL/TLS libraries? This question and desktop applications are protected by SSL/TLS protocols against network attacks. However, many vulnerabilities caused poses the following challenges: by incorrect use of SSL/TLS APIs have been uncovered in recent • Defining and representing correct use. Given an SSL years. Such vulnerabilities, many of which are caused due to poor library, how do we model correct use of the API to API design and inexperience of application developers, often lead to confidential data leakage or man-in-the-middle attacks. In this facilitate detection? paper, to guarantee code quality and logic correctness of SSL/TLS • Analysis techniques for incorrect usage in software. applications, we design and implement SSLINT, a scalable, Given a representation of correct usage, how do we de- automated, static analysis system for detecting incorrect use sign techniques for analyzing programs to detect incorrect of SSL/TLS APIs.
    [Show full text]
  • Open Source Software Notices
    Intergraph G/Technology® 10.04.2003 Open Source Software Licenses, Notices, and Information This information is provided for Intergraph G/Technology®, a software program of Intergraph® Corporation D/B/A Hexagon Safety & Infrastructure® (“Hexagon”). Source Code Access Intergraph G/Technology® may include components licensed pursuant to open source software licenses with an obligation to offer the recipient source code. Please see below the list of such components and the information needed to access the source code repository for each. In the event the source code is inaccessible using the information below or physical media is desired, please email [email protected]. Component, version Link to download repository DirectShow .NET v2.1 https://sourceforge.net/projects/directshownet/files/DirectShowNET/ DotSpatial.NetTopologySuite https://github.com/DotSpatial/NetTopologySuite 1.14.4 GeoAPI.NET 1.7.4.3 https://github.com/DotSpatial/GeoAPI Open Source Software Components Intergraph G/Technology® may include the open source software components identified on the following page(s). This document provides the notices and information regarding any such open source software for informational purposes only. Please see the product license agreement for Intergraph G/Technology® to determine the terms and conditions that apply to the open source software. Hexagon reserves all other rights. @altronix/linq-network-js 0.0.1-alpha-2 : MIT License @microsoft.azure/autorest.java 2.1.0 : MIT License anrl trunk-20110824 : MIT License aspnet/Docs 20181227-snapshot-68928585
    [Show full text]
  • You Really Shouldn't Roll Your Own Crypto: an Empirical Study of Vulnerabilities in Cryptographic Libraries
    You Really Shouldn’t Roll Your Own Crypto: An Empirical Study of Vulnerabilities in Cryptographic Libraries Jenny Blessing Michael A. Specter Daniel J. Weitzner MIT MIT MIT Abstract A common aphorism in applied cryptography is that cryp- The security of the Internet rests on a small number of open- tographic code is inherently difficult to secure due to its com- source cryptographic libraries: a vulnerability in any one of plexity; that one should not “roll your own crypto.” In par- them threatens to compromise a significant percentage of web ticular, the maxim that complexity is the enemy of security traffic. Despite this potential for security impact, the character- is a common refrain within the security community. Since istics and causes of vulnerabilities in cryptographic software the phrase was first popularized in 1999 [52], it has been in- are not well understood. In this work, we conduct the first voked in general discussions about software security [32] and comprehensive analysis of cryptographic libraries and the vul- cited repeatedly as part of the encryption debate [26]. Conven- nerabilities affecting them. We collect data from the National tional wisdom holds that the greater the number of features Vulnerability Database, individual project repositories and in a system, the greater the risk that these features and their mailing lists, and other relevant sources for eight widely used interactions with other components contain vulnerabilities. cryptographic libraries. Unfortunately, the security community lacks empirical ev- Among our most interesting findings is that only 27.2% of idence supporting the “complexity is the enemy of security” vulnerabilities in cryptographic libraries are cryptographic argument with respect to cryptographic software.
    [Show full text]
  • Ten Strategies of a World-Class Cybersecurity Operations Center Conveys MITRE’S Expertise on Accumulated Expertise on Enterprise-Grade Computer Network Defense
    Bleed rule--remove from file Bleed rule--remove from file MITRE’s accumulated Ten Strategies of a World-Class Cybersecurity Operations Center conveys MITRE’s expertise on accumulated expertise on enterprise-grade computer network defense. It covers ten key qualities enterprise- grade of leading Cybersecurity Operations Centers (CSOCs), ranging from their structure and organization, computer MITRE network to processes that best enable effective and efficient operations, to approaches that extract maximum defense Ten Strategies of a World-Class value from CSOC technology investments. This book offers perspective and context for key decision Cybersecurity Operations Center points in structuring a CSOC and shows how to: • Find the right size and structure for the CSOC team Cybersecurity Operations Center a World-Class of Strategies Ten The MITRE Corporation is • Achieve effective placement within a larger organization that a not-for-profit organization enables CSOC operations that operates federally funded • Attract, retain, and grow the right staff and skills research and development • Prepare the CSOC team, technologies, and processes for agile, centers (FFRDCs). FFRDCs threat-based response are unique organizations that • Architect for large-scale data collection and analysis with a assist the U.S. government with limited budget scientific research and analysis, • Prioritize sensor placement and data feed choices across development and acquisition, enteprise systems, enclaves, networks, and perimeters and systems engineering and integration. We’re proud to have If you manage, work in, or are standing up a CSOC, this book is for you. served the public interest for It is also available on MITRE’s website, www.mitre.org. more than 50 years.
    [Show full text]