[Problem] openssl FREAK fix for freetz stable?

[avidscavenger]

Hello,

Can anyone help me follow what is happening with openssl updates to fix the FREAK vulnerability? From what I can understand with my poor German and the help of Google translate, revision 13021 should contain a fix. But I am at revision 13055 of the stable release and don't see the fix, and https://tools.keycdn.com/freak still reports a vulnerability on my port 443.

Many thanks,
Jonathan

 

[PeterPawn]

and https://tools.keycdn.com/freak still reports a vulnerability on my port 443.

Am I right if I guess, that port 443 is the original manufacturer's web-interface?

Afaik no Freetz update will fix the FREAK vulnerability there ever, 'cause the contained libssl.so/libcrypto.so couple (in /usr/lib/freetz) does not replace the original ones (in /lib). Therefore the AVM code will continue to use the original libraries until AVM releases a new version without the vulnerability.

 

[avidscavenger]

Ah, of course. AVM seems to be claiming that their firmware has no vulnerability, but that doesn't seem to be accurate. So disabling remote access seems to be the only solution. Should be easy enough to tunnel over ssh if I need remote access.

Thank you for your help!