OpenSSL version 3.0.4, released on June 21th 2022, is susceptible to remote memory corruption which can be triggered trivially by an attacker. BoringSSL, LibreSSL and the OpenSSL 1.1.1 branch are not affected. Furthermore, only x64 systems with AVX512 support are affected. The bug is fixed in the repository but a new release is still pending. Continue reading Notes on OpenSSL remote memory…
Larry Stefonic of wolfSSL contacted me after he’d noticed my project for fuzzing cryptographic libraries called Cryptofuzz. We agreed that I would write a Cryptofuzz module for wolfSSL. I activated the wolfSSL module for Cryptofuzz on Google’s OSS-Fuzz, where it has been running 24/7 since. So far, Cryptofuzz has found a total of 8 bugs Continue reading Fuzzing for wolfSSL
Cryptofuzz Cryptofuzz is a project that fuzzes cryptographic libraries and compares their output in order to find implementation discrepancies. It s quite effective and has already found a lot of bugs. It s been running continually on Google s OSS-Fuzz for a while and most of the recent bugs were found by their machines. Not all of these Continue reading Differential fuzzing of cryptographic…
The attached document describes a new fuzz testing engine I have been busy with. As a power user of fuzzing libraries I ve noticed some shortcomings (in my view) of the existing offers, and decided to scratch my own itch. Enjoy! PDF LINK.
I wrote a fuzzer for libsrtp for purely recreational reasons. I reported the bugs I found to the libsrtp security mailing list several months ago. Finally those bugs seem to have been fixed in the git master tree. Apparently these findings and fixes for them don t seem to prompt a new release. Cisco has stopped Continue reading Full disclosure: libsrtp multiple vulnerabilities
A security audit of the widely used SoftEther VPN open source VPN client and server software [1] has uncovered 11 remote security vulnerabilities. The audit has been commissioned by the Max Planck Institute for Molecular Genetics [2] and performed by Guido Vranken [3]. The issues found range from denial-of-service resulting from memory leaks to memory Continue reading Security audit of SoftEther…
In May I started building fuzzers for OpenVPN because I liked engaging in the challenge of finding more vulnerabilities after two fresh audits. I never intended or expected to receive money for this. In addition to the money donated by people and companies to my Bitcoin address (thank you very much again), OSTIF reached out Continue reading Thank you very much OSTIF
This concerns a remote buffer overflow vulnerability in OpenVPN. It has been fixed in OpenVPN 2.4.4 and 2.3.18. It is suspected that only a small number of users is vulnerable to this issue, because it requires having explicitly enabled the outdated key method 1 . The advisory can be found here: https://community.openvpn.net/openvpn/wiki/CVE-2017-12166 If you appreciate my Continue reading One…
I got some requests to fuzz Bitcoin, so I did. They can be found here: https://github.com/guidovranken/bitcoin/tree/fuzzing/fuzzers I expect them to be merged into the main project soon. So far only one issue has been found: https://github.com/bitcoin/bitcoin/pull/11081 . This code is currently unused and does not pose a security risk (forks of Bitcoin may want to Continue reading Bitcoin fuzzers
FreeRADIUS is the most widely deployed RADIUS server in the world. It is the basis for multiple commercial offerings. It supplies the AAA needs of many Fortune-500 companies and Tier 1 ISPs. (http://freeradius.org) FreeRADIUS asked me to fuzz their DHCP and RADIUS packet parsers in version 3.0.x (stable branch) and version 2.2.x (EOL, but receives Continue reading 11 remote vulnerabilities (inc.…