OpenSSL Security Advisory [07 Apr 2014]
======================================== TLS heartbeat read overrun (CVE-2014-0160) ========================================== A missing bounds check in the handling of the TLS heartbeat extension can be used to reveal up to 64k of memory to a connected client or server. Only 1.0.1 and 1.0.2-beta releases of OpenSSL are affected including 1.0.1f and 1.0.2-beta1. Thanks for Neel Mehta of Google Security for discovering this bug and to Adam Langley <agl@chromium.org> and Bodo Moeller <bmoeller@acm.org> for preparing the fix. Affected users should upgrade to OpenSSL 1.0.1g. Users unable to immediately upgrade can alternatively recompile OpenSSL with -DOPENSSL_NO_HEARTBEATS. 1.0.2 will be fixed in 1.0.2-beta2.
More information:
- https://bugzilla.redhat.com/show_bug.cgi?id=1084875
- http://heartbleed.com/
- http://www.openssl.org/news/secadv_20140407.txt
- http://www.centosblog.com/critical-openssl-vulnerability-heartbleed-openssl-1-0-1-1-0-1f-patch-bug-centos-system/
- http://arstechnica.com/security/2014/04/critical-crypto-bug-in-openssl-opens-two-thirds-of-the-web-to-eavesdropping/
- http://serverfault.com/questions/587329/heartbleed-what-is-it-and-what-are-options-to-mitigate-it
- http://seclists.org/fulldisclosure/2014/Apr/92
- https://isc.sans.edu/diary/OpenSSL+CVE-2014-0160+Fixed/17917
Check you OpenSSL Version (CentOS):
- #openssl version
- #openssl version -a
- #rpm -q openssl
- #yum update openssl
- #rpm -q --changelog openssl-1.0.1e | grep -B 1 CVE-2014-0160
How can I check if my HTTPS site is still vulnerable?
- You can use http://filippo.io/Heartbleed/ to test if your HTTPS site is vulnerable (thanks to Filipo).
OpenSSL 1.0.1g has been released to fix "A missing bounds check in the handling of the TLS heartbeat extension can be used to reveal up to 64kB of memory to a connected client or server. This issue did not affect versions of OpenSSL prior to 1.0.1."[1] known as the Heartbleed Bug [3].
/*** update by Johannes Ullrich ...: ***/
Ubuntu released a patch for affected versions:
http://people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-0160.html
Ubuntu also updated OpenSSH.
CentOS/RHEL has a patch available.
https://rhn.redhat.com/errata/RHSA-2014-0376.html
For CentOS, the OpenSSL version did not change. Instead, only the compile time changed. To test if you are running the right version, look at the second line of the "openssl version -a" output:
Fixed version:
$ openssl version -a | head -2
OpenSSL 1.0.1e-fips 11 Feb 2013
built on: Tue Apr 8 02:39:29 UTC 2014
Old version:
OpenSSL 1.0.1e-fips 11 Feb 2013
built on: Wed Jan 8 18:40:59 UTC 2014
You probably want to make sure you at least restart affected daemons that load OpenSSL, or just reboot the system.
If you are concerend that the vulnerability was already used to read memory from your systems, you at least should change your SSL keys.
---
The quickest way to figure out which version of OpenSSL you are using is:
openssl version -a
But not that some software may be compiled statically with openssl.
For a vulnerable system, this will return a version of 1.0.1f (or anything but 'g'). Also there will be no complier flag-DOPENSL_NO_HEARTBEATS.
אין תגובות:
הוסף רשומת תגובה