I decided to take a look at the buffer overflow found in openssl pass phrase prompt described here:

http://www.securityfocus.com/archive/1/522927

vapid:/etc/openssl/CA# /tmp/openssl ca -config /etc/ssl/openssl.cnf -in server.csr -extensions v3_ca -out server.crt
Using configuration from /etc/ssl/openssl.cnf
Enter pass phrase for /etc/openssl/CA/private/cakey.pem:
Segmentation fault (core dumped)


vapid:/etc/openssl/CA# gdb /tmp/openssl core
GNU gdb (GDB) 7.0.1-debian
Copyright (C) 2009 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "i486-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /tmp/openssl...done.

warning: Can't read pathname for load map: Input/output error.
Reading symbols from /lib/i686/cmov/libdl.so.2...(no debugging symbols found)...done.
Loaded symbols for /lib/i686/cmov/libdl.so.2
Reading symbols from /lib/i686/cmov/libc.so.6...(no debugging symbols found)...done.
Loaded symbols for /lib/i686/cmov/libc.so.6
Reading symbols from /lib/ld-linux.so.2...(no debugging symbols found)...done.
Loaded symbols for /lib/ld-linux.so.2
Core was generated by `/tmp/openssl ca -config /etc/ssl/openssl.cnf -in server.csr -extensions v3_ca -'.
Program terminated with signal 11, Segmentation fault.
#0  EVP_BytesToKey (type=0x41414141, md=0x8198fe0, salt=0xbfbea3a0 'A' <repeats 200 times>...,
    data=0xbfbe9e8c 'A' <repeats 200 times>..., datal=4095, count=1, key=0xbfbea318 'A' <repeats 200 times>..., iv=0x0)
    at evp_key.c:119
119        nkey=type->key_len;
(gdb) bt
#0  EVP_BytesToKey (type=0x41414141, md=0x8198fe0, salt=0xbfbea3a0 'A' <repeats 200 times>...,
    data=0xbfbe9e8c 'A' <repeats 200 times>..., datal=4095, count=1, key=0xbfbea318 'A' <repeats 200 times>..., iv=0x0)
    at evp_key.c:119
#1  0x08115fb7 in PEM_do_header (cipher=0xbfbea39c, data=0x41414141 <Address 0x41414141 out of bounds>, plen=0x41414141,
    callback=0x41414141, u=0x41414141) at pem_lib.c:414
#2  0x41414141 in ?? ()  It appears it is exploitable (if stack protection was turned off) at first glance.
Backtrace stopped: previous frame inner to this frame (corrupt stack?)
(gdb)  info regi eip
eip            0x80f827d    0x80f827d <EVP_BytesToKey+29>  Using configuration from /etc/ssl/openssl.cnf
unable to load CA private key
32595:error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt:evp_enc.c:330:
32595:error:0906A065:PEM routines:PEM_do_header:bad decrypt:pem_lib.c:428: