0

I checked a site with this tool and the result came back that " This server is vulnerable to the OpenSSL CCS vulnerability (CVE-2014-0224) and exploitable."

I searched around and found that for not being vulnerable the version must be higher than this output:

OpenSSL 1.0.1 14 Mar 2012
built on: Mon Jun 2 19:37:18 UTC 2014

My current version is

OpenSSL 1.0.1c 10 May 2012
built on: Fri May  2 20:25:02 UTC 2014

I tried couple ways to upgrade my openssl like this and this but I still get the same version. For example when I execute the sudo apt-get dist-upgrade I get this message:

Reading package lists... Done
Building dependency tree       
Reading state information... Done
Calculating upgrade... Done
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.

The first time I run this command, packages were installed and I did reboot my machine with sudo reboot.

Any clue how can I update my openSSL to avoid this vulnerability? Anything else I might be missing?

3
  • Before doing the apt-get dist-upgrade, I assume you also did an apt-get update? Also, given that Ubuntu (and many other Linux distributions) backports security fixes you will need to provide the full package version. In Debian/Ubuntu you can get that information by running apt-cache policy openssl.
    – andol
    Jul 31, 2014 at 10:24
  • 2
    Wait a second here, OpenSSL 1.0.1c? Any chance that you running Ubuntu 12.10? That Ubuntu version is no longer supported, hence no recent security fixes.
    – andol
    Jul 31, 2014 at 10:32
  • yes I am running 12.10 :| Jul 31, 2014 at 10:35

2 Answers 2

2

Ok, as suggested in the question comments your problem is that you are running Ubuntu 12.10, which stoped being supported earlier this year, just about a month before the OpenSSL CCS issue was published. Hence, there aren't any good OpenSSL versions for Ubuntu 12.10, and there won't be.

Getting an openssl/libssl packages from a newer Ubuntu might not be trivial, given that other packages you have installed might depend on a specific openssl version. Seem to recall libssl being fairly version critical when compiled against.

While there are things you could do, such as backporting the fix yourself (non-trivial) you really need to upgrade to a supported version of Ubuntu, given all other potential security issues in other packages. Especially since you appear to be running a web server, which usually has a fairly large attack surface.

For a server you usually want to go with a LTS version of Ubuntu. Especially these days, with the new non-LTS versions only being supported nine months, and the LTS versions getting five years of supported. Current LTS versions being Ubuntu 12.04 and Ubuntu 14.04.

1

The openssl library may be up-to-date but already started software may be using the old version.

After each shared library update, every software using it should be restarted to use the new version.

The package debian-goodies contains a script : checkrestart that will list the software running with old versions of updated libraries and suggest the restart of affected daemons.

1
  • thank you for posting. that's what I got: Found 0 processes using old versions of upgraded files Jul 31, 2014 at 10:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .