I decided to take a look at the buffer overflow found in openssl
pass phrase prompt described here:
http://www.securityfocus.com/archive/1/522927
vapid:/etc/openssl/CA# /tmp/openssl ca -config /etc/ssl/openssl.cnf
-in server.csr -extensions v3_ca -out server.crt
Using configuration from /etc/ssl/openssl.cnf
Enter pass phrase for /etc/openssl/CA/private/cakey.pem:
Segmentation fault (core dumped)
vapid:/etc/openssl/CA# gdb /tmp/openssl core
GNU gdb (GDB) 7.0.1-debian
Copyright (C) 2009 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later
<http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type
"show copying"
and "show warranty" for details.
This GDB was configured as "i486-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /tmp/openssl...done.
warning: Can't read pathname for load map: Input/output error.
Reading symbols from /lib/i686/cmov/libdl.so.2...(no debugging
symbols found)...done.
Loaded symbols for /lib/i686/cmov/libdl.so.2
Reading symbols from /lib/i686/cmov/libc.so.6...(no debugging
symbols found)...done.
Loaded symbols for /lib/i686/cmov/libc.so.6
Reading symbols from /lib/ld-linux.so.2...(no debugging symbols
found)...done.
Loaded symbols for /lib/ld-linux.so.2
Core was generated by `/tmp/openssl ca -config /etc/ssl/openssl.cnf
-in server.csr -extensions v3_ca -'.
Program terminated with signal 11, Segmentation fault.
#0 EVP_BytesToKey (type=0x41414141, md=0x8198fe0,
salt=0xbfbea3a0 'A' <repeats 200 times>...,
data=0xbfbe9e8c 'A' <repeats 200 times>...,
datal=4095, count=1, key=0xbfbea318 'A' <repeats 200
times>..., iv=0x0)
at evp_key.c:119
119 nkey=type->key_len;
(gdb) bt
#0 EVP_BytesToKey (type=0x41414141, md=0x8198fe0,
salt=0xbfbea3a0 'A' <repeats 200 times>...,
data=0xbfbe9e8c 'A' <repeats 200 times>...,
datal=4095, count=1, key=0xbfbea318 'A' <repeats 200
times>..., iv=0x0)
at evp_key.c:119
#1 0x08115fb7 in PEM_do_header (cipher=0xbfbea39c,
data=0x41414141 <Address 0x41414141 out of bounds>,
plen=0x41414141,
callback=0x41414141, u=0x41414141) at
pem_lib.c:414
#2 0x41414141 in ?? () It appears it is exploitable (if stack protection was
turned off) at first glance.
Backtrace stopped: previous frame inner to this frame (corrupt
stack?)
(gdb) info regi eip
eip 0x80f827d
0x80f827d <EVP_BytesToKey+29>
Using configuration from /etc/ssl/openssl.cnf
unable to load CA private key
32595:error:06065064:digital envelope
routines:EVP_DecryptFinal_ex:bad decrypt:evp_enc.c:330:
32595:error:0906A065:PEM routines:PEM_do_header:bad
decrypt:pem_lib.c:428: