CVE:CVE-2014-0016
CNNVD:CNNVD-201403-423
Stunnel是比利时软件开发者Michal Trojnara所研发的一套用于提供全局的TLS/SSL服务的跨平台软件。该软件可对本身无法进行TLS或SSL通信的客户端及服务器提供安全的加密连接。
Stunnel 4.56及之前版本中存在安全漏洞，该漏洞源于当使用fork线程时，程序没有正确更新OpenSSL伪随机数发生器(PRNG)的状态，造成后续带有相同进程ID的子进程使用相同的熵池。远程攻击者可利用该漏洞获取EC (ECDSA)或DSA证书的私钥。
solution:Upgrade stunnel stunnel to a higher version than 4.56,0.1,1.0,1.1,1.2,1.3,1.4,1.5,1.6,2.0,2.1,3.0,3.0:b1,3.0:b2,3.0:b3,3.0:b4,3.0:b5,3.0:b6,3.0:b7,3.1,3.2,3.3,3.4a,3.5,3.6,3.7,3.8,3.8:p1,3.8:p2,3.8:p3,3.8:p4,3.8p1,3.8p2,3.8p3,3.8p4,3.9,3.10,3.11,3.12,3.13,3.14,3.15,3.16,3.17,3.18,3.19,3.20,3.21,3.21a,3.21b,3.21c,3.22,3.23,3.24,3.25,3.26,4.00,4.0,4.01,4.02,4.03,4.04,4.05,4.06,4.07,4.08,4.09,4.10,4.11,4.12,4.13,4.14,4.15,4.16,4.17,4.18,4.19,4.20,4.21,4.22,4.23,4.24,4.25,4.26,4.27,4.28,4.29,4.30,4.31,4.32,4.33,4.34,4.35,4.36,4.37,4.38,4.39,4.40,4.41,4.42,4.43,4.44,4.45,4.46,4.47,4.48,4.49,4.50,4.51,4.52,4.53,4.54,4.55,and avoid the version (,4.56],0.1,1.0,1.1,1.2,1.3,1.4,1.5,1.6,2.0,2.1,3.0,3.0:b1,3.0:b2,3.0:b3,3.0:b4,3.0:b5,3.0:b6,3.0:b7,3.1,3.2,3.3,3.4a,3.5,3.6,3.7,3.8,3.8:p1,3.8:p2,3.8:p3,3.8:p4,3.8p1,3.8p2,3.8p3,3.8p4,3.9,3.10,3.11,3.12,3.13,3.14,3.15,3.16,3.17,3.18,3.19,3.20,3.21,3.21a,3.21b,3.21c,3.22,3.23,3.24,3.25,3.26,4.00,4.0,4.01,4.02,4.03,4.04,4.05,4.06,4.07,4.08,4.09,4.10,4.11,4.12,4.13,4.14,4.15,4.16,4.17,4.18,4.19,4.20,4.21,4.22,4.23,4.24,4.25,4.26,4.27,4.28,4.29,4.30,4.31,4.32,4.33,4.34,4.35,4.36,4.37,4.38,4.39,4.40,4.41,4.42,4.43,4.44,4.45,4.46,4.47,4.48,4.49,4.50,4.51,4.52,4.53,4.54,4.55