5

We're currently using Ubuntu 10.04 and based on the PCI Compliance results, we're told to upgrade our OpenSSL.

I attempted to do this using this reference and this.

Unfortunately, they didn't work for me. And when I attempted to remove the old version prior to installation, it looks like it broke a few thins in the system.

The article from Steve Gordon seemed like it would work for me, but when I ran the openssl version command, it still read that it was the old version.

I was wondering if anyone has any suggestions on what I should do.

Fix: After following the steps from Steven Gordon, make sure you restart apache and / or restart your computer (I did both, but I'm sure a simple restart will fix it right up).

2 Answers 2

2

upgrading openssl is going to make things worse, not better. You need to get a list of CVEs that are concerning whoever is doing your PCI certification. Then you can, for each of these CVE's show them that Ubuntu is backporting patches to address these CVEs.

Here is Ubuntu's security tracker. You should be able to put a CVE into this site, and find out that Ubuntu has addressed the issue, and when.

For example, the most recent openssl CVE is documented here, and that links to Ubuntu's notice about this vulnerability being fixed.

The company doing your PCI certification SHOULD accept this kind of documentation.

1

If you need to upgrade OpenSSL, your options are either to upgrade your entire OS so that the new version of OpenSSL is in place via the OS's supported packages, or venture down the winding and often problematic path of either installing from source or using a third-party package repository.

You may not need to upgrade at all, though. Keep in mind that security fixes from newer versions are backported into older packages. Security scans often have false positives due to their reliance on a simple version number check; the package changelog shows that it's regularly getting security updates. Verify that you're actually vulnerable to the findings before you spend a ton of time and effort on upgrading.

6
  • Hi Shane, thanks for looking into my post. I would upgrade the entire OS to 12.04 LTS, but it's currently not an option for me. What I did attempt to do was follow the difficult path of installing from a source through openssl.org/source for the 1.0.1c version
    – Nina
    Aug 31, 2012 at 16:29
  • Gotcha. Well, if the install was successful, you'll have a working OpenSSL binary at the new install path - verify with /usr/local/ssl/bin/openssl version. If that works, then the next challenge will be getting your applications using the new version - what service is running OpenSSL that's getting flagged for vulnerabilities? Aug 31, 2012 at 16:41
  • I have it claiming to say the version is still 0.9.8k. The one that's telling us to upgrade it was the PCI Compliance when we failed the network scan and told us to upgrade to the latest version
    – Nina
    Aug 31, 2012 at 16:53
  • Are you running just openssl version, or with the full path to where the new install's binary should be (/usr/local/ssl/bin/)? Aug 31, 2012 at 16:58
  • i was running it with the full path to where /usr/local/ssl/bin was which is strange since that's where the new install went
    – Nina
    Aug 31, 2012 at 17:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .