Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We're currently using Ubuntu 10.04 and based on the PCI Compliance results, we're told to upgrade our OpenSSL.

I attempted to do this using this reference and this.

Unfortunately, they didn't work for me. And when I attempted to remove the old version prior to installation, it looks like it broke a few thins in the system.

The article from Steve Gordon seemed like it would work for me, but when I ran the openssl version command, it still read that it was the old version.

I was wondering if anyone has any suggestions on what I should do.

Fix: After following the steps from Steven Gordon, make sure you restart apache and / or restart your computer (I did both, but I'm sure a simple restart will fix it right up).

share|improve this question
add comment

2 Answers

upgrading openssl is going to make things worse, not better. You need to get a list of CVEs that are concerning whoever is doing your PCI certification. Then you can, for each of these CVE's show them that Ubuntu is backporting patches to address these CVEs.

Here is Ubuntu's security tracker. You should be able to put a CVE into this site, and find out that Ubuntu has addressed the issue, and when.

For example, the most recent openssl CVE is documented here, and that links to Ubuntu's notice about this vulnerability being fixed.

The company doing your PCI certification SHOULD accept this kind of documentation.

share|improve this answer
add comment

If you need to upgrade OpenSSL, your options are either to upgrade your entire OS so that the new version of OpenSSL is in place via the OS's supported packages, or venture down the winding and often problematic path of either installing from source or using a third-party package repository.

You may not need to upgrade at all, though. Keep in mind that security fixes from newer versions are backported into older packages. Security scans often have false positives due to their reliance on a simple version number check; the package changelog shows that it's regularly getting security updates. Verify that you're actually vulnerable to the findings before you spend a ton of time and effort on upgrading.

share|improve this answer
    
Hi Shane, thanks for looking into my post. I would upgrade the entire OS to 12.04 LTS, but it's currently not an option for me. What I did attempt to do was follow the difficult path of installing from a source through openssl.org/source for the 1.0.1c version –  Nina Aug 31 '12 at 16:29
    
Gotcha. Well, if the install was successful, you'll have a working OpenSSL binary at the new install path - verify with /usr/local/ssl/bin/openssl version. If that works, then the next challenge will be getting your applications using the new version - what service is running OpenSSL that's getting flagged for vulnerabilities? –  Shane Madden Aug 31 '12 at 16:41
    
I have it claiming to say the version is still 0.9.8k. The one that's telling us to upgrade it was the PCI Compliance when we failed the network scan and told us to upgrade to the latest version –  Nina Aug 31 '12 at 16:53
    
Are you running just openssl version, or with the full path to where the new install's binary should be (/usr/local/ssl/bin/)? –  Shane Madden Aug 31 '12 at 16:58
    
i was running it with the full path to where /usr/local/ssl/bin was which is strange since that's where the new install went –  Nina Aug 31 '12 at 17:14
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.