[tor-bugs] #4822 [Tor Client]: Avoid vulnerability CVE-2011-4576 : Disable SSL3?

[Tor Bug Tracker & Wiki]

#4822: Avoid vulnerability CVE-2011-4576 : Disable SSL3?
------------------------+---------------------------------------------------
 Reporter:  nickm       |          Owner:                    
     Type:  defect      |         Status:  needs_review      
 Priority:  critical    |      Milestone:  Tor: 0.2.1.x-final
Component:  Tor Client  |        Version:                    
 Keywords:              |         Parent:                    
   Points:              |   Actualpoints:                    
------------------------+---------------------------------------------------

Comment(by rransom):

 Replying to [comment:14 nickm]:
 > Replying to [comment:11 rransom]:
 > > Replying to [comment:9 nickm]:
 > > > Okay, please look at branch bug4822_021_v2 in my public repository.
 It takes the SSL_OP_NO_SSLv3 approach.

 > > I still think we should use a runtime version check, not a compile-
 time version check -- people ''will'' build Tor against an old OpenSSL
 shared library and run it with a new one.
 >
 > Hm. That case is actually safe; the problem would be if they built with
 a newer one and ran with an older one.  Does that seem likely?  And
 shouldn't a decent library system prevent this?

 The dangerous case could happen with packages for one Linux distribution
 used on a different distribution (e.g. packages built on and for Ubuntu
 used on Mint, before Mint updates its OpenSSL packages).  But if there is
 no reason to try to enable SSL 3 whenever it is safe to do so, we
 shouldn't make this change depend on OpenSSL's version at all.

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/4822#comment:15>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online