Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've updated my Ubuntu server to use OpenSSL 1.0.1g and when I run sudo openssl version -a I get OpenSSL 1.0.1g 7 Apr 2014 built on: Sat Apr 19 14:15:45 UTC 2014 platform: linux-elf

However, sites like https://filippo.io/Heartbleed/ are still returning my site as vulnerable to Heartbleed. I have restarted the server, not sure what else I have to do.

Is there a way to find any services that are currently running and are vulnerable to the Hearbleed security issue?

Anyone else having this problem?

share|improve this question
1  
What are you using to terminate SSL? Apache, nginx, pound, stunnel, etc.? Could it be that you have a custom build of one of these which is statically linked? –  chrskly Apr 19 at 14:52
1  
Why did you build your own instead of using the Ubuntu-provided security update? –  Michael Hampton Apr 19 at 15:37
    
Did you also update libssl? –  EEAA Apr 19 at 17:30

2 Answers 2

up vote 1 down vote accepted

I can think of a few problems that would cause this:

  1. Possibly some form of a caching issue, not sure if you have any caching enabled on your sites, but I would look there.
  2. Apache being built on an older OpenSSL version. In this case you need to recompile it, or depending on OS use yum/apt-get to remove it and reinstall it.
  3. Did you remember to restart Apache after making the change to OpenSSL?

If you provide more details I may be able to assist further.

share|improve this answer
    
#2 It was running an old version of Apache that wasn't recognizing the updated OpenSSL version. All is set now. Thanks :) –  Brian W Apr 20 at 19:42

Heartbleed can be exploited if you have a service running, that is actively using a vulnerable openssl version.

This could be a service providing https. After fixing the openssl-stack (like you tried to do) and after verifying the service (like you did) the last step, after you are not vulnerable any longer, is to treat all involved keys as compromised.

That is: Mark them as compromised and get new ones.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.