Thema: SSH/SSL/VPN Tools...

[SiLæncer]

Changelog

attempt to add IPv6 route even when no IPv6 address was configured
fix redirect-gateway behaviour when an IPv4 default route does not exist
CRL: use time_t instead of struct timespec to store last mtime
ignore remote-random-hostname if a numeric host is provided
man: fix formatting for alternative option
systemd: Use automake tools to install unit files
systemd: Do not race on RuntimeDirectory
systemd: Add more security feature for systemd units
Clean up plugin path handling
plugin: Remove GNUism in openvpn-plugin.h generation
fix typo in notification message
management: >REMOTE operation would overwrite ce change indicator
management: Remove a redundant #ifdef block
git: Merge .gitignore files into a single file
systemd: Move the READY=1 signalling to an earlier point
plugin: Improve the handling of default plug-in directory
cleanup: Remove faulty env processing functions
OpenSSL: check for the SSL reason, not the full error
OpenSSL: don't use direct access to the internal of X509_STORE_CTX
OpenSSL: don't use direct access to the internal of SSL_CTX
OpenSSL: don't use direct access to the internal of X509_STORE
OpenSSL: don't use direct access to the internal of X509_OBJECT
OpenSSL: don't use direct access to the internal of RSA_METHOD
OpenSSL: SSLeay symbols are no longer available in OpenSSL 1.1
OpenSSL: use EVP_CipherInit_ex() instead of EVP_CipherInit()
Fix Building Using MSVC
Add openssl_compat.h to openvpn_SOURCES
Fix '--dev null'
Fix installation of IPv6 host route to VPN server when using iservice.
Make ENABLE_OCC no longer depend on !ENABLE_SMALL
Preparing for release v2.4.1 (ChangeLog, version.m4)
Crash in options.c
Resolve several travis-ci issues
travis-ci: remove unused files
Fix building with LibreSSL 2.5.1 by cleaning a hack.
Fix push options digest update
Always release dhcp address in close_tun() on Windows.
Add a check for -Wl, --wrap support in linker
Fix user's group membership check in interactive service to work with domains
Fix segfault when using crypto lib without AES-256-CTR or SHA256
More broadly enforce Allman style and braces-around-conditionals
Use SHA256 for the internal digest, instead of MD5
OpenSSL: 1.1 fallout - fix configure on old autoconf
Fix types in WIN32 socket_listen_accept()
Remove duplicate X509 env variables
Fix non-C99-compliant builds: don't use const size_t as array length
Deprecate --ns-cert-type
Be less picky about keyUsage extensions

[close]

http://openvpn.net/

[SiLæncer]

Whats new:>>

Fixed a rarely occurring race condition which could cause the SSH Client to terminate when closing an SFTP channel.

www.bitvise.com

[SiLæncer]

Version 5.41, 2017.04.01, urgency: MEDIUM

* New features

  - PKCS#11 engine DLL updated to version 0.4.5.
  - Default engine UI set with ENGINE_CTRL_SET_USER_INTERFACE.
  - Key file name added into the passphrase console prompt.
  - Performance optimization in memory leak detection.

* Bugfixes

  - Fixed crashes with the OpenSSL 1.1.0 branch.
  - Fixed certificate verification with "verifyPeer = yes"
    and "verifyChain = no" (the default), while the peer
    only returns a single certificate.

https://www.stunnel.org/index.html

[SiLæncer]

Changelog

Security fix: the Windows PuTTY binaries should no longer be vulnerable to hijacking by specially named DLLs in the same directory, even the names we missed when we thought we'd fixed this in 0.68. See vuln-indirect-dll-hijack-2.
Windows PuTTY should work with MIT Kerberos again, after our DLL hijacking defences broke it.
Jump lists should now appear again on the PuTTY shortcut in the Windows Start Menu.
You can now explicitly configure SSH terminal mode settings not to be sent to the server, if your server objects to them.

[close]

http://www.chiark.greenend.org.uk/~sgtatham/putty/

[SiLæncer]

Changelog

This is not a new feature release, but a successor to 7.29 with continued maintenance updates. (We skip over versions containing zeros to avoid ambiguities. For example, 7.03 and 7.30 might both be referred to as "7.3".)
Small changes in key places improve CPU efficiency on the order of 30% (impact may depend on the system). This improves transfer speeds where CPU is the bottleneck – or maintaining same performance, allows for a greater number of simultaneous connections. Users who were previously maxing out a single core and seeing transfer speeds of e.g. 150 MB/s, may now see e.g. 200 MB/s.
Fixed VT-100 keyboard mappings. Function keys will now be sent correctly over VT-100 and xterm when VT-100 mode is enabled. Adapted navigation keys for VT-100, including: Insert, Delete, Home, End, Page Up, and Page Down.
Removed unnecessary input length limitations in user authentication input boxes by permitting scrolling. This should allow the use of long YubiKey two-factor authentication strings using the method keyboard-interactive.
Diffie-Hellman key exchange algorithms that use group exchange are once again deprioritized, regardless of which cryptographic provider is in use. This means other key exchange algorithms will again be preferred. In version 7.21, we stopped deprioritizing these algorithms because our Windows CNG cryptographic provider can handle dynamic DH group parameters generated by servers like OpenSSH. However, there remain older servers, such as SunSSH, which generate DH groups which are not acceptable to any of our cryptographic providers.

[close]

www.bitvise.com

[SiLæncer]

Changelog

Bugfixes

    Fix memory leak introduced in 2.4.1: if --remote-cert-tls is used, we leaked some memory on each TLS (re)negotiation.

Security

    Fix a pre-authentication denial-of-service attack on both clients and servers. By sending a too-large control packet, OpenVPN 2.4.0 or 2.4.1 can be forced to hit an ASSERT() and stop the process. If --tls-auth or --tls-crypt is used, only attackers that have the --tls-auth or --tls-crypt key can mount an attack. (OSTIF/Quarkslab audit finding 5.1, CVE-2017-7478)
    Fix an authenticated remote DoS vulnerability that could be triggered by causing a packet id roll over. An attack is rather inefficient; a peer would need to get us to send at least about 196 GB of data. (OSTIF/Quarkslab audit finding 5.2, CVE-2017-7479)

[close]

http://openvpn.net/

[SiLæncer]

Whats new:>>

- New feature: Run multiple instances of WinSSHTerm
- New feature: Master password (File->Master Password)
- Minor changes

http://winsshterm.blogspot.com/

[SiLæncer]

Whats new:>>

* merge with PuTTY 0.69
* new feature: new option to disable winrol
* bug fix: launcher - in case of explorer crash and restart, icon in system tray did not redraw

http://www.9bis.net/kitty/?page=Welcome&zone=en

[SiLæncer]

Changelog

  *) Have 'config' recognise 64-bit mingw and choose 'mingw64' as the target
     platform rather than 'mingw'.
     [Richard Levitte]

  *) Remove the VMS-specific reimplementation of gmtime from crypto/o_times.c.
     VMS C's RTL has a fully up to date gmtime() and gmtime_r() since V7.1,
     which is the minimum version we support.
     [Richard Levitte]

[close]

http://www.openssl.org/

[SiLæncer]

Whats new:>>

- Bug fix: While setting a master password the contents of the two text fields were not properly compared
- Minor improvements to the Multi-Input feature
- Minor changes

http://winsshterm.blogspot.com/

[SiLæncer]

Whats new:>>

- Fixed a small GUI bug which accidently entered in version 1.11.1

http://winsshterm.blogspot.com/

[SiLæncer]

WinSSHTerm helps you to be more productive. Using keyboard shortcuts and intelligent navigation tools allows you to quickly switch between or start new SSH sessions even if you have to manage many systems. It has built-in support for copying files and running X applications. The terminal colors are carefully selected to minimize the stress for your eyes. WinSSHTerm is easy to use, lightweight and stable.

Freeware

Whats new:>>

- Bug fix: Key combinations in the "Config" window are possible again

http://winsshterm.blogspot.com/

[SiLæncer]

Whats new:>>

New features:

"redirect" also supports "exec" and not only "connect".

Bugfixes:

Fixed a hang on shutdown.
Fixed "verifyPeer = yes" on OpenSSL <= 1.0.1.

https://www.stunnel.org/index.html

[SiLæncer]

PuTTYTabManager is a handy application that allows you to run multiple PuTTY applications using a single GUI. The application support all the PuTTY protocols, such as SSH, Telnet, Rlogin and Raw.

The tab-based interface makes the application very easy to use, enabling you to manage multiple PuTTY sessions at the same time. Instead of opening multiple PuTTY windows, simply open PuTTYTabManager and initiate every session in a new tab.

Freeware

Whats new: >>

Several minor improvements
Several minor bugs fixed

https://sites.google.com/site/macdsite/utilidades/puttytabmanager

[SiLæncer]

Changelog

Antonio Quartulli (1):

Ignore auth-nocache for auth-user-pass if auth-token is pushed

David Sommerseth (3):

crypto: Enable SHA256 fingerprint checking in --verify-hash
copyright: Update GPLv2 license texts
auth-token with auth-nocache fix broke --disable-crypto builds

Emmanuel Deloget (8):

OpenSSL: don't use direct access to the internal of X509
OpenSSL: don't use direct access to the internal of EVP_PKEY
OpenSSL: don't use direct access to the internal of RSA
OpenSSL: don't use direct access to the internal of DSA
OpenSSL: force meth->name as non-const when we free() it
OpenSSL: don't use direct access to the internal of EVP_MD_CTX
OpenSSL: don't use direct access to the internal of EVP_CIPHER_CTX
OpenSSL: don't use direct access to the internal of HMAC_CTX

Gert Doering (6):

Fix NCP behaviour on TLS reconnect.
Remove erroneous limitation on max number of args for --plugin
Fix edge case with clients failing to set up cipher on empty PUSH_REPLY.
Fix potential 1-byte overread in TCP option parsing.
Fix remotely-triggerable ASSERT() on malformed IPv6 packet.
Preparing for release v2.4.3 (ChangeLog, version.m4, Changes.rst)

Guido Vranken (6):

refactor my_strupr
Fix 2 memory leaks in proxy authentication routine
Fix memory leak in add_option() for option 'connection'
Ensure option array p[] is always NULL-terminated
Fix a null-pointer dereference in establish_http_proxy_passthru()
Prevent two kinds of stack buffer OOB reads and a crash for invalid input data

Jérémie Courrèges-Anglas (2):

Fix an unaligned access on OpenBSD/sparc64
Missing include for socket-flags TCP_NODELAY on OpenBSD

Matthias Andree (1):

Make openvpn-plugin.h self-contained again.

Selva Nair (1):

Pass correct buffer size to GetModuleFileNameW()

Steffan Karger (11):

Log the negotiated (NCP) cipher
Avoid a 1 byte overcopy in x509_get_subject (ssl_verify_openssl.c)
Skip tls-crypt unit tests if required crypto mode not supported
openssl: fix overflow check for long --tls-cipher option
Add a DSA test key/cert pair to sample-keys
Fix mbedtls fingerprint calculation
mbedtls: fix --x509-track post-authentication remote DoS (CVE-2017-7522)
mbedtls: require C-string compatible types for --x509-username-field
Fix remote-triggerable memory leaks (CVE-2017-7521)
Restrict --x509-alt-username extension types
Fix potential double-free in --x509-alt-username (CVE-2017-7521)

Steven McDonald (1):

Fix gateway detection with OpenBSD routing domains

[close]

http://openvpn.net/