Might wanna recompile or patch that OpenSSL, buddy (4/7/2014)

texteditor · Apr 7, 2014

http://heartbleed.com/

http://blog.cloudflare.com/staying-ahead-of-openssl-vulnerabilities

https://access.redhat.com/security/cve/CVE-2014-0160

https://www.openssl.org/news/secadv_20140407.txt

OpenSSL's TLS ~1.0.1 through 1.0.2+ has a leak in the heatbeat extension that can cause private key leakage. A patched version is out allegedly, or you can rebuild OpenSSL with the -DOPENSSL_NO_HEARTBEATS. flag

Happy patchin'

tchen · Apr 7, 2014

Useful test

http://filippo.io/Heartbleed

HalfEatenPie · Apr 7, 2014

Thanks a ton! Pretty important information right here!

sv01 · Apr 7, 2014

thanks, just update my Debian

thedediguy · Apr 7, 2014

why thank you

jarland · Apr 7, 2014

Thanks for the heads up. All patched where it matters. The rest...meh hack away

Easily scripted for centos 6, for the lazy. Stolen entirely from a source Ryan linked me to and turned into a quick bash script to make it faster to push.

http://dal.jarland.me/openssl.sh

Source: http://www.ptudor.net/linux/openssl/

wlanboy · Apr 8, 2014

Damn - just thinking about re-issue my SSL cert.

peterw · Apr 8, 2014

tchen said:
Useful test

http://filippo.io/Heartbleed

All of my domains are vulnerable. Shit.

George_Fusioned · Apr 8, 2014

After updating the OpenSSL package, check which services are using the old OpenSSL libraries with 'lsof -n | grep ssl | grep DEL' - then restart as needed.

eva2000 · Apr 8, 2014

CentOS updated openssl is available now according to https://rhn.redhat.com/errata/RHSA-2014-0376.html

Code:

yum list openssl openssl-devel -q
Installed Packages
openssl.x86_64                                                             1.0.1e-16.el6_5.4                                                       @updates
openssl-devel.x86_64                                                       1.0.1e-16.el6_5.4                                                       @updates
Available Packages
openssl.x86_64                                                             1.0.1e-16.el6_5.7                                                       updates 
openssl-devel.x86_64                                                       1.0.1e-16.el6_5.7                                                       updates

Nikki · Apr 8, 2014

Debian Wheezy also has an updated openssl.

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=743883

perennate · Apr 8, 2014

vpsboard still vulnerable?

howardsl2 · Apr 8, 2014

Relevant changelog for Ubuntu openssl package:

https://launchpad.net/ubuntu/+source/openssl/+changelog

Run "apt-get update; apt-get upgrade" to see other software that have been updated in the Ubuntu repos. Before doing that, make sure you have "deb http://security.ubuntu.com/ubuntu ... " in your "/etc/apt/sources.list".

Ishaq · Apr 8, 2014

By the way, OpenSSH is NOT vulnerable to this. Because it does not use the TLS protocol. So you don't need to worry about changing keypairs, etc.

Nikki · Apr 8, 2014

Here's a better script to test your servers, found it earlier after searching around. When it comes to things like this, even if a site seems very trustworthy you should never rely on them to test vulnerabilities.

https://gist.github.com/takeshixx/10107280

DomainBop · Apr 8, 2014

George_Fusioned said:
After updating the OpenSSL package, check which services are using the old OpenSSL libraries with 'lsof -n | grep ssl | grep DEL' - then restart as needed.

I think that bears repeating.

Also, if you have an OpenVZ VPS, depending on the kernel version, that command may not give any output and so you may have to run just "lsof -n | grep ssl" and restart anything that uses SSL to be on the safe side (or you could just reboot...)

On another note, I just discovered that lsof wasn't installed on my Vultr Tokyo VPS (fixed by apt-get lsof)

Magiobiwan · Apr 8, 2014

FYI, CentOS 6.5 will still have the version "e" version string, but it WAS Backported.

jarland · Apr 8, 2014

Got the update today. Apparently the guide+script I linked before doesn't fix it, I just got false negatives from that test site and I'm not ashamed to say I couldn't test this exploit if my life depended on it. Yum update it is!

MannDude · Apr 8, 2014

perennate said:
vpsboard still vulnerable?

Still waiting to get my cert reissued. Already ran the updates and still getting positives, though now the site is claiming it's issuing false positives due to load...

DomainBop · Apr 8, 2014

Nikki said:
Debian Wheezy also has an updated openssl.

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=743883

Debian Wheezy has issued 2 fixes in the past 24 hours so if you updated it last night you need to do it again.

1.0.1e-2+deb7u5 <--last night's upgrade

1.0.1e-2+deb7u6 <--today's upgrade (today's upgrade will restart some services but not all so you'll still need to check with lsof or reboot)

Might wanna recompile or patch that OpenSSL, buddy (4/7/2014)

Premium Buffalo-based Hosting

New Member

The Irrational One

Slow but sure

New Member

The ocean is digital

Content Contributer

New Member

Active Member

Active Member

New Member

New Member

New Member

New Member

New Member

Dormant VPSB Pathogen

Insert Witty Statement Here

The ocean is digital

Just a dude

Dormant VPSB Pathogen