Skip to Content.
Sympa Menu

freetds - Re: [freetds] freetds have some ssl security problems

freetds AT lists.ibiblio.org

Subject: FreeTDS Development Group

List archive

Chronological Thread  
  • From: "何博远" <heboyuan AT zju.edu.cn>
  • To: "FreeTDS Development Group" <freetds AT lists.ibiblio.org>
  • Subject: Re: [freetds] freetds have some ssl security problems
  • Date: Fri, 24 Oct 2014 19:07:32 +0800

IMO, for self-signed certificate, it's still necessary to do verification.
For example, the client certificate in MS SQLserver is signed by a root
certificate in server. User can also configure there own root certificate
for SQLserver in order to secure the SSL connection. So I agree that there
should be locations of root certificate in the clients and also there should
at least an option for certificate verification, otherwise SSL is pointless.‍


Thanks.
Roca
------------------ Original ------------------
From: "Frediano Ziglio";<freddy77 AT gmail.com>;
Date: Fri, Oct 24, 2014 00:12 AM
To: "FreeTDS Development Group"<freetds AT lists.ibiblio.org>;

Subject: Re: [freetds] freetds have some ssl security problems



2014-10-23 16:06 GMT+01:00 Frediano Ziglio <freddy77 AT gmail.com>:
> 2014-10-23 15:14 GMT+01:00 润青杨 <rainkin1993 AT gmail.com>:
>> Hi guys,
>> Recently, our group are trying to find ssl security problems by static
>> anlysis. Now we have find some problems in freetds-bin and report this bugs
>> to the launchpad, but we haven't receive any responses.
>> Could you please take a look at this bug:
>> https://bugs.launchpad.net/ubuntu/+source/freetds/+bug/1376592
>> Thanks,
>> Rainkin
>
>
> Thank you,
> I think you are right.
>
> However there is mainly a problem in the default configuration. By
> default when you install a server it use quite silently a self-signed.
> This means mainly that a man in the middle is just behind the door.
>
> Frediano

Yes, there should be some option. Specifically we should test
everything having some options to disable some checks. Also location
for root certificate should be required.

Frediano
_______________________________________________
FreeTDS mailing list
FreeTDS AT lists.ibiblio.org
http://lists.ibiblio.org/mailman/listinfo/freetds


Archive powered by MHonArc 2.6.24.

Top of Page