Path: csiph.com!newsfeed.hal-mli.net!feeder3.hal-mli.net!newsfeed.hal-mli.net!feeder1.hal-mli.net!us.feeder.erje.net!feeder.erje.net!eu.feeder.erje.net!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail
From: Arno Welzel <usenet@arnowelzel.de>
Newsgroups: comp.lang.php
Subject: Re: Heartbleed bug?
Date: Thu, 10 Apr 2014 22:54:01 +0200
Lines: 45
Message-ID: <534704E9.9050904@arnowelzel.de>
References: <38941292-a3a7-4dc0-ba31-873351d81924@googlegroups.com>     <li3h9p$ab4$1@dont-email.me> <VaadncnjeJs3zNjOnZ2dnUVZ_gmdnZ2d@giganews.com> <li3oid$2up$1@dont-email.me> <53456ab0$0$6618$9b4e6d93@newsspool4.arcor-online.net> <li40fs$8bs$1@dont-email.me> <53463F6B.5010406@arnowelzel.de> <li60kv$vd4$1@dont-email.me>
Mime-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
X-Trace: individual.net TawfhHqkc2R0j4rEMnDnOAVcVF+6GCgUZUsstpOBU9uGWF5Gyg
Cancel-Lock: sha1:iWa8l5qQmXDeLyq3tf5s962hHJI=
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Thunderbird/24.4.0
In-Reply-To: <li60kv$vd4$1@dont-email.me>
X-Enigmail-Version: 1.6
Xref: csiph.com comp.lang.php:13379

Jerry Stuckle, 2014-04-10 13:52:

> On 4/10/2014 2:51 AM, Arno Welzel wrote:
>> Jerry Stuckle, 2014-04-09 19:37:
>>
>>> On 4/9/2014 11:43 AM, Christoph Michael Becker wrote:
>> [...]
>>>> ACK.  However, the Windows x86 builds of PHP 5.5.11 shipped OpenSSL
>>>> 1.0.1f (6 Jan 2014) and have been updated to ship OpenSSL 1.0.1g (7 Apr
>>>> 2014) just a few hours ago.  (The x64 builds are currently being worked
>>>> on.)  So obviously PHP's OpenSSL extension is affected by the
>>>> "heartbleed" bug (at least on Windows).
>>>>
>>>
>>> Does it?  Or does it mean they just want to keep up with the latest
>>> release?  And if it does affect PHP, what functions does it affect, and
>>> how does it affect them?
>>
>> I assume PHP does keep up with the latest release because they *are*
>> affected by the bug e.g. in stream_socket_enable_crypto().
>>
>>
> 
> You can ASS-U-ME all you want.  I go by the facts.  And if I were 

Oh you are so funny...

> concerned about PHP being involved, I would ask the OpenSSL people.

The fact is, that stream_socket_enable_crypto() allows to build a server
which listens on a socket to accept incoming SSL/TLS connections and
uses OpenSSL for this.

OpenSSL up to 1.0.1f has a now well known vulnerability for that use case.

Ask who ever you want. If you got the answers that prove all this wrong,
do the rest of us a favour and tell us.



-- 
Arno Welzel
http://arnowelzel.de
http://de-rec-fahrrad.de
http://fahrradzukunft.de