Linked Questions

10
votes
1answer
2k views

I am still running Ubuntu 13.04, how should I react to the Heartbleed Bug? [duplicate]

I know that 13.04 is affected (or at least my installation is) because of the OpenSSL version currently installed. However, after running sudo apt-get update sudo apt-get upgrade I checked my ...
2
votes
1answer
5k views

How to upgrade OpenSSL on CentOS 6.5 to protect against heartbleed? [duplicate]

When I go to run: root@vps [~]# yum update -y openssl I get: Loaded plugins: fastestmirror Loading mirror speeds from cached hostfile * base: mirror.beyondhosting.net * extras: ...
1
vote
2answers
7k views

How to upgrade OpenSSL on Ubuntu Server 12.04 LTS? (Heartbleed) [duplicate]

How do I upgrade OpenSSL using Ubuntu's repository? I see the USN at http://www.ubuntu.com/usn/usn-2165-1/ and the package here https://launchpad.net/ubuntu/+source/openssl/1.0.1-4ubuntu5.12 but I ...
1
vote
1answer
2k views

Heartbleed flaw fix on Debian Wheezy [duplicate]

is there any 100% working method to update openssl to the non vulnerable version on Debian Wheezy. I do not want to upgrade the whole OS, nor would I like to install a non official package. Is there ...
10
votes
1answer
305 views

How do we instruct our employees to protect themselves from Heartbleed? [duplicate]

Welcome to the world after heartbleed. We've patched our servers and are replacing our SSL certificates. But just because our servers are fixed, that doesn't mean that the rest of the internet is ...
-4
votes
1answer
118 views

Heartbleed: What if OpenSSL has been patched but SSL certs not yet rekeyed? [duplicate]

Does anyone know what entry point a hacker could have if a sever's OpenSSL has been patched but a site's SSL certs have not yet been rekeyed? Thanks!
0
votes
2answers
91 views

Possible Heartbleed Compromise recovery [duplicate]

I have a web-server, (complete with user account and payment system), that was vulnerable to the Heartbleed attack. What I'm wondering is: How can I detect if my server has been compromised? How do ...
2
votes
0answers
100 views

Best method to update ubuntu 13.10 to path the HeartBleed bug [duplicate]

So we are running ubuntu 13.10 in production and they have OpenSSL 1.0.1e 11 Feb 2013, which obviously needs to be patched. What's the best way to do it without any downtime? What will happen to the ...
-2
votes
1answer
74 views

Heartbleed - Centos 6.5, Apache - should I recreate pair of default certificate and key [duplicate]

I am using Centos 6.5, Apache 2.2.15 with SSL. Due to heartbleed I have updated openssl to release 16.el6_5.7 and I have restarted the httpd service. I am using default Apache certificate and key: ...
0
votes
0answers
25 views

Should I completely rebuild my server due to Heartbleed? [duplicate]

I have a CentOS 6.5 VPS server... $ uname -a Linux mary 3.14.4-x86_64-linode40 #1 SMP Tue May 13 12:25:05 EDT 2014 \ x86_64 x86_64 x86_64 GNU/Linux When the news about the Heartbleed ...
73
votes
8answers
31k views

Heartbleed: how to reliably and portably check the OpenSSL version?

I was looking at a reliable and portable way to check the OpenSSL version on GNU/Linux and other systems, so users can easily discover if they should upgrade their SSL because of the Heartbleed bug. ...
53
votes
6answers
12k views

Heartbleed: are services other than HTTPS affected?

The OpenSSL 'heartbleed' vulnerability (CVE-2014-0160) affects webservers serving HTTPS. Other services also use OpenSSL. Are these services also vulnerable to heartbleed-like data leakage? I'm ...
9
votes
4answers
4k views

Do I Need to Replace Keys for OpenSSH in Response to Heartbleed?

I've already updated my servers with the patches. Do I need to regenerate any private keys with respect to OpenSSH? I know that I have to regenerate any SSL certificates. EDIT: I didn't word this ...
3
votes
2answers
2k views

debian wheezy, heartbleed, openssl refuses to update

I am having a strange problem, my system is exposed to heartbleed, and I am trying to fix it by using: apt-get clean, apt-get update and apt-get upgrade openssl but the response is: Reading ...

15 30 50 per page