Welcome! Log In Create A New Profile

VU#120541/CVE-2009-3555 and IMAPS/POPS with nginx

Forum List Message List New Topic Print View

Quanah Gibson-Mount

November 20, 2009 06:20PM

I've patched nginx, and tested https, POPS, and IMAPS. https fails
correctly:

---
R
RENEGOTIATING

3915:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake
failure:s3_pkt.c:529:

However, POPS and IMAPS do not:

---
* OK IMAP4 ready
R
RENEGOTIATING

<hangs forever>

---
+OK POP3 ready
R
RENEGOTIATING

<hangs forever>

It seems the patch only correctly handles HTTPS, and not these other
protocols.

--Quanah

--

Quanah Gibson-Mount
Principal Software Engineer
Zimbra, Inc
--------------------
Zimbra :: the leader in open source messaging and collaboration

Reply Quote

RSS

Subject	Author	Posted
VU#120541/CVE-2009-3555 and IMAPS/POPS with nginx	Quanah Gibson-Mount	November 20, 2009 06:20PM
Re: VU#120541/CVE-2009-3555 and IMAPS/POPS with nginx	Maxim Dounin	November 20, 2009 07:16PM
Re: VU#120541/CVE-2009-3555 and IMAPS/POPS with nginx	Quanah Gibson-Mount	November 20, 2009 07:22PM
Re: VU#120541/CVE-2009-3555 and IMAPS/POPS with nginx	Maxim Dounin	November 20, 2009 07:54PM
Re: VU#120541/CVE-2009-3555 and IMAPS/POPS with nginx	Quanah Gibson-Mount	November 20, 2009 08:20PM
Re: VU#120541/CVE-2009-3555 and IMAPS/POPS with nginx	Maxim Dounin	November 20, 2009 09:56PM
Re: VU#120541/CVE-2009-3555 and IMAPS/POPS with nginx	Quanah Gibson-Mount	November 20, 2009 10:06PM