The Heartbleed bug is a vulnerability in OpenSSL's TLS implementation. The CVE ID for this issue is CVE-2014-0160

learn more… | top users | synonyms

8
votes
2answers
668 views

How to install a vulnerable version of OpenSSL on a Linux server?

I'd like to compile and install a Heartbleed-vulnerable OpenSSL version on a server I'm setting up for a team web security challenge (since these are not available for install from Ubuntu's repository ...
0
votes
2answers
38 views

Does Ubuntu 12.04LTS have the OpenSSL heartbleed fix?

Only OpenSSL 1.0.1f or later has the fix for the heartbleed exploit. So does Ubuntu 12.04LTS have the fix? We need to use 12.04LTS for reasons I won't go into, and we can't upgrade. According to this ...
-1
votes
2answers
38 views

Openssl upgrade from source [closed]

I have upgraded the openssl version on my server to the latest version of openssl but the libraries that the reverse proxy server is using is pointing to . strings /usr/lib64/libssl.so.10 | grep ...
2
votes
1answer
305 views

HeartBleed Openssl update Redhat Enterprise server 6.3

I already update using yum update openssl but still my server is vulnerable. Tried grep 'libssl.*(deleted)' /proc/*/maps and no result as I already restarted the server. Yet, it is still vulnerable. ...
0
votes
0answers
68 views

Updating openssl to fix heartbleed bug tries to remove redis-server

I am trying to fix openssl heartbleed bug on my server. I read that I can update the openssl version with the following command: sudo apt-get install openssl libssl1.0.0 But when i try to run this ...
4
votes
1answer
720 views

Why do I get different openssl versions?

I'm trying to check if I running the latest OpenSSL version, my main concern is the heartbleed bug. I tried 2 commands: openssl version yum info openssl openssl version output OpenSSL ...
0
votes
0answers
25 views

Should I completely rebuild my server due to Heartbleed? [duplicate]

I have a CentOS 6.5 VPS server... $ uname -a Linux mary 3.14.4-x86_64-linode40 #1 SMP Tue May 13 12:25:05 EDT 2014 \ x86_64 x86_64 x86_64 GNU/Linux When the news about the Heartbleed ...
0
votes
1answer
172 views

Heartbleed not fixed by Openssl and server upgrade

I have inherited a server in one of our Dev environments and found out straight away that it was not patched when the heartbleed was discovered. Now, I've upgraded it - including all SSL libraries ...
-2
votes
1answer
78 views

Heartbleed - Centos 6.5, Apache - should I recreate pair of default certificate and key [duplicate]

I am using Centos 6.5, Apache 2.2.15 with SSL. Due to heartbleed I have updated openssl to release 16.el6_5.7 and I have restarted the httpd service. I am using default Apache certificate and key: ...
3
votes
2answers
2k views

debian wheezy, heartbleed, openssl refuses to update

I am having a strange problem, my system is exposed to heartbleed, and I am trying to fix it by using: apt-get clean, apt-get update and apt-get upgrade openssl but the response is: Reading ...
5
votes
2answers
1k views

Upgrading SSL library does not fix heartbleed

I have just upgraded the openssl library on my Ubuntu 12.04 server to fix the heartbleed bug. Here's the output that I get for the "openssl version -a" command: OpenSSL 1.0.0g 18 Jan 2012 built on: ...
0
votes
1answer
162 views

Can Heartbleed cause a server to crash?

I know about the basic Heartbleed vulnerability and it's consequences and cause. However, I recently read that Heartbleed may cause a server to crash. I am wondering if this statement is true and if ...
0
votes
1answer
305 views

apache taking old openssl libraries when doing apachectl graceful

Due to heartbleed vulnerability I have recompiled apache with non vulnerable latest openssl(I had to keep old vulnerable openssl due to some dependency problem). It is running fine and when doing ...
1
vote
1answer
58 views

Heartbleed self-test for mailserver

The internet is now inundated by sites like this: https://ssl-tools.net/heartbleed-test Which is great, but these then immediately publish the vulnerable domains. I have a number of private ...
0
votes
2answers
286 views

Verify OpenVPN is no longer vulnerable to Heartbleed

As you may know, OpenVPN is vulnerable to the heartbleed attack. However, I can't find any guide online on how to fix it. The only source I've found is this: ...
13
votes
3answers
5k views

How do I check if my SSL certificates have been revoked

The recent discovery of the heartbleed vulnerability has prompted certificate authorities to re-issue certificates. I have two certificates that were generated before the heartbleed vulnerability ...
-4
votes
1answer
120 views

Heartbleed: What if OpenSSL has been patched but SSL certs not yet rekeyed? [duplicate]

Does anyone know what entry point a hacker could have if a sever's OpenSSL has been patched but a site's SSL certs have not yet been rekeyed? Thanks!
0
votes
2answers
114 views

I have OpenSSL 1.0.1g but my site is still vulnerable?

I've updated my Ubuntu server to use OpenSSL 1.0.1g and when I run sudo openssl version -a I get OpenSSL 1.0.1g 7 Apr 2014 built on: Sat Apr 19 14:15:45 UTC 2014 platform: linux-elf However, sites ...
1
vote
3answers
168 views

Open SSL - Is my ubuntu really secure now after dist-upgrade?

I am running a Ubuntu 12.04 server and I just updated the server with (and rebooted afterwards) sudo apt-get dist-upgrade Now the open SSL version sais, it is build on 7 Apr 2014 what is good, but ...
2
votes
1answer
125 views

Switch the SSL provider after Heartbleed bug instead of revoking

I have a question regarding the Heartbleed problem and the SSL certificates. About Heartbleed many people say that admins should revoke their certificates and get new ones. I got my SSL certs from ...
0
votes
1answer
109 views

Was my server vulnerable to heartbleed if TLS has been disabled?

Was my server vulnerable to heartbleed if TLS has been disabled in the past? In apaches vhost configuration the parameter sslCipherSuite contains only SSLv2 afaik this doesn't contain TLS.
1
vote
1answer
347 views

Command line tool for fetching and analyzing SSL certificate

Following the heartbleed vulnerability in openSSL, all the SSH certificate on our servers were re-issued and re-installed. Since it is likely that we've missed something on a server (for example, ...
0
votes
1answer
240 views

OpenSSH and heartbleed? [duplicate]

I just updated a Debian Wheezy server for the first time today, after the heartbleed bug. OpenSSL is not installed on this server, so I thought the server was not affected, and therefore it was put on ...
4
votes
2answers
2k views

Server still vulnerable to HeartBleed after Openssl update

On a Centos 6.5 Minimal install, I have compiled Apache, PHP, and rpm installed Percona. After updating OpenSSL days ago, my site that uses SSL on this server is vulnerable to Heartbleed somehow. ...
1
vote
1answer
253 views

Can't upgrade Ubuntu 12.04.4 LTS to fix Heartbleed - Errors with nagios-nrpe-server and bind9

an anyone help? I am trying to upgrade but a get error messages about nagios-nrpe-server and bind. Here is the console output: >apt-get upgrade Reading package lists... Done Building dependency ...
0
votes
1answer
653 views

How to disable SSL-VPN on FortiOS 5.0

Hearbleed issue. Must disable SSL-VPN. I wasnt able to find it in the GUI. Might there happen to be a CLI command?
0
votes
2answers
213 views

Openssl heartbleed update not working with compiled Apache 2.4.7

We are still having heartbleed issues with one of our servers. We did the update with yum and restarted apache and any service that was using the vulnerable version of openssl. When we test our site ...
0
votes
2answers
755 views

Which versions of win32 tcnative-1.dll are succeptible to heartbleed

We are trying to determine our window of vulnerability for Heartbleed. Does anyone have an idea of how to determine which version of OpenSSL was used to build a given Tomcat Native DLL? Our server ...
0
votes
2answers
227 views

Upgrade to secure openssl fails

Upgrade to secure openssl fails Method: have in /etc/apt/sources.list: deb http://security.debian.org/ wheezy/updates main contrib non-free Then do: apt-get update apt-cache policy openssl ...
2
votes
1answer
59 views

How to reset self-signed keys that allow remote shell access to server in (Debian) linux

This is not something I've ever had to do before, and in light of the heartbleed bug I've been looking for a guide of how to do it properly, but all I can find are guides on how to log into a server ...
0
votes
2answers
134 views

Is the danger of the heartbleed bug worse than using non-ssl connections?

Trying to understand everything while reading http://heartbleed.com/ This sentence Leaked secret keys allows the attacker to decrypt any past and future traffic to the protected services and to ...
0
votes
1answer
346 views

Will tcnative-1.dll version 1.1.30 work with tomcat 7.0.29 without any issues?

In order to fix the Heartbleed vulnerability a new release of the tomcat java native libraries is being created. Will this release work with older versions of Tomcat 7 such as 7.0.29, or will this ...
1
vote
1answer
447 views

Heartbleed vulnerability when SSL provided by unaffected servers?

*I'd like to ask about two scenarios where a vulnerable version of OpenSSL is installed on a server, but that server is not providing SSL services. Scenario 1: I have an SSL certificate installed on ...
-1
votes
2answers
193 views

Is a server running iis with a certificate issued by godaddy vulnerable to heartbleed [closed]

Is a server running IIS that is hosted by rackspace but using an SSL certificate issued by godaddy vulnerable to heartbleed? Since it seemed that somebody thought this was worthy of down-voting, let ...
1
vote
2answers
140 views

Is ISC BIND unaffected with OpenSSL Heartbleed bug?

There is a bug Heartbleed in OpenSSL. I built ISC BIND 9.9.5 with OpenSSL 1.0.1e enable. Should I re-built BIND with OpenSSL 1.0.1g?
-2
votes
1answer
371 views

Fedora 15 openssl heartbleed [closed]

I am running a fedora 15 2.6.32-042stab081.3 x64, I have OpenSSL 1.0.0j-fips 10 May 2012 which I understand to not be infected. However every test tool out there is reporting the site maybe ...
0
votes
1answer
146 views

Could Certificate Authorities have been compromised by the Heartbleed bug? [closed]

OpenSSL is widely used and was affected by the Heartbleed bug for years. A lot of services were impacted and everybody is trying to recover from this bug by updating there system, generating new ...
4
votes
1answer
2k views

Windows 2003 heartbleed bug openssl fix

As recommended by openssl.org I'm trying to update OpenSSL from 1.0.1e to 1.0.1g. Fixes for most linux distributions have already deployed, but, what should be done on windows? we are using win server ...
0
votes
0answers
74 views

How to better block phishing spam due to heartbleed?

I imagine it won't take long for spammers to recognize that Heartbleed is an ideal way to do phishing. I am thinking of ways to mitigate the phishing risk, I mean just this time for the heartbleed ...
0
votes
2answers
94 views

Possible Heartbleed Compromise recovery [duplicate]

I have a web-server, (complete with user account and payment system), that was vulnerable to the Heartbleed attack. What I'm wondering is: How can I detect if my server has been compromised? How do ...
4
votes
2answers
1k views

Is OpenVPN UDP vulnerable to heartbleed?

Is OpenVPN UDP vulnerable to heartbleed? I need to decide if I'm going to rebuild some servers, but they are very carefully firewalled; 1194/TCP is one of the firewalled ports (yay whitelist!). ...
2
votes
0answers
56 views

Still vulnerable to Heartbleed after updating and reboot [duplicate]

I'm on Ubuntu 12.04, I have updated openssl with the latest update : $ openssl version -a OpenSSL 1.0.1 14 Mar 2012 built on: Mon Apr 7 20:33:29 UTC 2014 And also updated libssl $ sudo apt-get ...
4
votes
4answers
7k views

Is there a way, to manually check for openssl CVE-2014-0160 vulnerability?

Is there a way for one to check some of internal services against CVE - CVE-2014-0160 (preferably using openssl CLI)? I CANNOT test everything just by using: Test your server for Heartbleed ...
8
votes
3answers
1k views

Do I have to update my snakeoil certificate after updating openssl (heartbleed)?

I just updated my debian wheezy server to the newest version of the openssl package which has the heartbleed bug fixed. I do support SSL on my server, but only with a snakeoil certificate. I was just ...
1
vote
2answers
688 views

How do I rotate an SSL Certificate as requested by AWS

Amazon AWS sent an email today that users using Elasic Load Balancing (ELB) service with SSL certificates should "Rotate" them for precaution (Heartbleed bug). How exactly do I rotate an ssl ...
0
votes
1answer
528 views

Heartbleed testing tools do not recognize reissued certificates (PositiveSSL Wildcard + Amazon ELB)

In response to the Heartbleed news, I have upgraded OpenSSL on my production server and am now trying to reissue the SSL certificate. I am using a PositiveSSL Wildcard certificate on an Amazon ELB. I ...
0
votes
1answer
159 views

App Engine, OpenSSL and Heartbleed

Has GAE ever used OpenSSL for its frontend servers? It’s quite interesting in the context of the Heartbleed security hole. It would be nice to get a confirmation from Google that no risks are present. ...
1
vote
1answer
3k views

Heartbleed flaw fix on Debian Wheezy [duplicate]

is there any 100% working method to update openssl to the non vulnerable version on Debian Wheezy. I do not want to upgrade the whole OS, nor would I like to install a non official package. Is there ...
2
votes
1answer
6k views

How to upgrade OpenSSL on CentOS 6.5 to protect against heartbleed? [duplicate]

When I go to run: root@vps [~]# yum update -y openssl I get: Loaded plugins: fastestmirror Loading mirror speeds from cached hostfile * base: mirror.beyondhosting.net * extras: ...
2
votes
2answers
741 views

How can I check if my embedded Linux's SSL is not affected by heartbleed, without relying on the version number?

There are a lot of embedded Linux device that are built on Linux, that are used exactly for security purposes, like gateways, if I check OpenSSL I get: openssl version -a gets -» OpenSSL 1.0.0k 5 ...