[stunnel-users] OpenSSL Vulnerabilities

Thu Apr 9 21:48:01 CEST 2009

On Thu, 2009-04-09 at 12:08 -0500, Guy wrote:
> Cal Webster wrote:
> 
> 
> > Do these SSL libraries still require "MSVCR90.dll" from the
> > "Visual C++ Redistributables"?
> > 
> > I appreciate the swift response. :-)
> > 
> 
> 
> No, the only Microsoft C Runtime Library dependency is MSVCRT.DLL
>  (see below output)

Thank you. I see that. I've also confirmed by uninstalling "Visual C++
Redistributables" and the OpenSSL package from "slproweb.com". The
stunnel service starts up and runs fine with the latest stunnel version
4.27b2.

-----------[From stunnel.log]-----------
2009.04.09 14:56:11 LOG7[1240:1236]: RAND_status claims sufficient
entropy for the PRNG
2009.04.09 14:56:11 LOG7[1240:1236]: PRNG seeded successfully
2009.04.09 14:56:11 LOG7[1240:1236]: SSL context initialized for service
vnc1
2009.04.09 14:56:11 LOG7[1240:1236]: SSL context initialized for service
vnc2
2009.04.09 14:56:11 LOG7[1240:1236]: SSL context initialized for service
vnc3
2009.04.09 14:56:11 LOG5[1240:1236]: stunnel 4.27 on x86-pc-mingw32-gnu
with OpenSSL 0.9.8k 25 Mar 2009
2009.04.09 14:56:11 LOG5[1240:1236]: Threading:WIN32 SSL:ENGINE
Sockets:SELECT,IPv4
2009.04.09 14:56:11 LOG5[1240:1260]: No limit detected for the number of
clients
2009.04.09 14:56:11 LOG7[1240:1260]: FD 312 in non-blocking mode
2009.04.09 14:56:11 LOG7[1240:1260]: SO_REUSEADDR option set on accept
socket
2009.04.09 14:56:11 LOG7[1240:1260]: vnc1 bound to 127.0.0.1:5973
2009.04.09 14:56:11 LOG7[1240:1260]: FD 320 in non-blocking mode
2009.04.09 14:56:11 LOG7[1240:1260]: SO_REUSEADDR option set on accept
socket
2009.04.09 14:56:11 LOG7[1240:1260]: vnc2 bound to 127.0.0.1:5972
2009.04.09 14:56:11 LOG7[1240:1260]: FD 328 in non-blocking mode
2009.04.09 14:56:11 LOG7[1240:1260]: SO_REUSEADDR option set on accept
socket
2009.04.09 14:56:11 LOG7[1240:1260]: vnc3 bound to 127.0.0.1:15900
-----------[/From stunnel.log]-----------

> > On Tue, 2009-04-07 at 19:34 -0500, Guy wrote:
...
> $ listdlls -r stunnel
> 
> ListDLLs v2.25 - DLL lister for Win9x/NT
> Copyright (C) 1997-2004 Mark Russinovich
> Sysinternals - www.sysinternals.com

Thank you for the link. I've downloaded and installed the GUI version,
"Process Explorer", on a test machine. I'm pleasantly surprised at its
utility and light impact on system resources.

One more question please:

Will the Win32 binaries at the link you provided
<ftp://stunnel.mirt.net/stunnel> keep up fairly closely with the latest
OpenSSL releases?

With OpenSSL so widely used it is constantly being evaluated for
vulnerabilities. When they're found, it is patched quickly but dependent
applications are sometimes slow to incorporate patched versions.

Thanks again for your excellent help.

./Cal