The Heartbleed bug is a vulnerability in OpenSSL's TLS implementation. The CVE ID for this issue is CVE-2014-0160

learn more… | top users | synonyms

2
votes
1answer
118 views

HeartBleed Openssl update Redhat Enterprise server 6.3

I already update using yum update openssl but still my server is vulnerable. Tried grep 'libssl.*(deleted)' /proc/*/maps and no result as I already restarted the server. Yet, it is still vulnerable. ...
0
votes
0answers
53 views

Updating openssl to fix heartbleed bug tries to remove redis-server

I am trying to fix openssl heartbleed bug on my server. I read that I can update the openssl version with the following command: sudo apt-get install openssl libssl1.0.0 But when i try to run this ...
4
votes
1answer
591 views

Why do I get different openssl versions?

I'm trying to check if I running the latest OpenSSL version, my main concern is the heartbleed bug. I tried 2 commands: openssl version yum info openssl openssl version output OpenSSL ...
0
votes
0answers
25 views

Should I completely rebuild my server due to Heartbleed? [duplicate]

I have a CentOS 6.5 VPS server... $ uname -a Linux mary 3.14.4-x86_64-linode40 #1 SMP Tue May 13 12:25:05 EDT 2014 \ x86_64 x86_64 x86_64 GNU/Linux When the news about the Heartbleed ...
0
votes
1answer
158 views

Heartbleed not fixed by Openssl and server upgrade

I have inherited a server in one of our Dev environments and found out straight away that it was not patched when the heartbleed was discovered. Now, I've upgraded it - including all SSL libraries ...
-2
votes
1answer
74 views

Heartbleed - Centos 6.5, Apache - should I recreate pair of default certificate and key [duplicate]

I am using Centos 6.5, Apache 2.2.15 with SSL. Due to heartbleed I have updated openssl to release 16.el6_5.7 and I have restarted the httpd service. I am using default Apache certificate and key: ...
3
votes
2answers
2k views

debian wheezy, heartbleed, openssl refuses to update

I am having a strange problem, my system is exposed to heartbleed, and I am trying to fix it by using: apt-get clean, apt-get update and apt-get upgrade openssl but the response is: Reading ...
5
votes
2answers
988 views

Upgrading SSL library does not fix heartbleed

I have just upgraded the openssl library on my Ubuntu 12.04 server to fix the heartbleed bug. Here's the output that I get for the "openssl version -a" command: OpenSSL 1.0.0g 18 Jan 2012 built on: ...
0
votes
1answer
148 views

Can Heartbleed cause a server to crash?

I know about the basic Heartbleed vulnerability and it's consequences and cause. However, I recently read that Heartbleed may cause a server to crash. I am wondering if this statement is true and if ...
0
votes
1answer
267 views

apache taking old openssl libraries when doing apachectl graceful

Due to heartbleed vulnerability I have recompiled apache with non vulnerable latest openssl(I had to keep old vulnerable openssl due to some dependency problem). It is running fine and when doing ...
1
vote
1answer
54 views

Heartbleed self-test for mailserver

The internet is now inundated by sites like this: https://ssl-tools.net/heartbleed-test Which is great, but these then immediately publish the vulnerable domains. I have a number of private ...
0
votes
2answers
205 views

Verify OpenVPN is no longer vulnerable to Heartbleed

As you may know, OpenVPN is vulnerable to the heartbleed attack. However, I can't find any guide online on how to fix it. The only source I've found is this: ...
12
votes
3answers
3k views

How do I check if my SSL certificates have been revoked

The recent discovery of the heartbleed vulnerability has prompted certificate authorities to re-issue certificates. I have two certificates that were generated before the heartbleed vulnerability ...
-4
votes
1answer
118 views

Heartbleed: What if OpenSSL has been patched but SSL certs not yet rekeyed? [duplicate]

Does anyone know what entry point a hacker could have if a sever's OpenSSL has been patched but a site's SSL certs have not yet been rekeyed? Thanks!
0
votes
2answers
106 views

I have OpenSSL 1.0.1g but my site is still vulnerable?

I've updated my Ubuntu server to use OpenSSL 1.0.1g and when I run sudo openssl version -a I get OpenSSL 1.0.1g 7 Apr 2014 built on: Sat Apr 19 14:15:45 UTC 2014 platform: linux-elf However, sites ...
1
vote
3answers
160 views

Open SSL - Is my ubuntu really secure now after dist-upgrade?

I am running a Ubuntu 12.04 server and I just updated the server with (and rebooted afterwards) sudo apt-get dist-upgrade Now the open SSL version sais, it is build on 7 Apr 2014 what is good, but ...
2
votes
1answer
122 views

Switch the SSL provider after Heartbleed bug instead of revoking

I have a question regarding the Heartbleed problem and the SSL certificates. About Heartbleed many people say that admins should revoke their certificates and get new ones. I got my SSL certs from ...
0
votes
1answer
102 views

Was my server vulnerable to heartbleed if TLS has been disabled?

Was my server vulnerable to heartbleed if TLS has been disabled in the past? In apaches vhost configuration the parameter sslCipherSuite contains only SSLv2 afaik this doesn't contain TLS.
1
vote
1answer
173 views

Command line tool for fetching and analyzing SSL certificate

Following the heartbleed vulnerability in openSSL, all the SSH certificate on our servers were re-issued and re-installed. Since it is likely that we've missed something on a server (for example, ...
0
votes
1answer
227 views

OpenSSH and heartbleed? [duplicate]

I just updated a Debian Wheezy server for the first time today, after the heartbleed bug. OpenSSL is not installed on this server, so I thought the server was not affected, and therefore it was put on ...
3
votes
2answers
2k views

Server still vulnerable to HeartBleed after Openssl update

On a Centos 6.5 Minimal install, I have compiled Apache, PHP, and rpm installed Percona. After updating OpenSSL days ago, my site that uses SSL on this server is vulnerable to Heartbleed somehow. ...
1
vote
1answer
242 views

Can't upgrade Ubuntu 12.04.4 LTS to fix Heartbleed - Errors with nagios-nrpe-server and bind9

an anyone help? I am trying to upgrade but a get error messages about nagios-nrpe-server and bind. Here is the console output: >apt-get upgrade Reading package lists... Done Building dependency ...
0
votes
1answer
407 views

How to disable SSL-VPN on FortiOS 5.0

Hearbleed issue. Must disable SSL-VPN. I wasnt able to find it in the GUI. Might there happen to be a CLI command?
0
votes
2answers
201 views

Openssl heartbleed update not working with compiled Apache 2.4.7

We are still having heartbleed issues with one of our servers. We did the update with yum and restarted apache and any service that was using the vulnerable version of openssl. When we test our site ...
0
votes
2answers
657 views

Which versions of win32 tcnative-1.dll are succeptible to heartbleed

We are trying to determine our window of vulnerability for Heartbleed. Does anyone have an idea of how to determine which version of OpenSSL was used to build a given Tomcat Native DLL? Our server ...
0
votes
2answers
189 views

Upgrade to secure openssl fails

Upgrade to secure openssl fails Method: have in /etc/apt/sources.list: deb http://security.debian.org/ wheezy/updates main contrib non-free Then do: apt-get update apt-cache policy openssl ...
2
votes
1answer
57 views

How to reset self-signed keys that allow remote shell access to server in (Debian) linux

This is not something I've ever had to do before, and in light of the heartbleed bug I've been looking for a guide of how to do it properly, but all I can find are guides on how to log into a server ...
0
votes
2answers
132 views

Is the danger of the heartbleed bug worse than using non-ssl connections?

Trying to understand everything while reading http://heartbleed.com/ This sentence Leaked secret keys allows the attacker to decrypt any past and future traffic to the protected services and to ...
0
votes
1answer
304 views

Will tcnative-1.dll version 1.1.30 work with tomcat 7.0.29 without any issues?

In order to fix the Heartbleed vulnerability a new release of the tomcat java native libraries is being created. Will this release work with older versions of Tomcat 7 such as 7.0.29, or will this ...
1
vote
1answer
426 views

Heartbleed vulnerability when SSL provided by unaffected servers?

*I'd like to ask about two scenarios where a vulnerable version of OpenSSL is installed on a server, but that server is not providing SSL services. Scenario 1: I have an SSL certificate installed on ...
-1
votes
2answers
186 views

Is a server running iis with a certificate issued by godaddy vulnerable to heartbleed [closed]

Is a server running IIS that is hosted by rackspace but using an SSL certificate issued by godaddy vulnerable to heartbleed? Since it seemed that somebody thought this was worthy of down-voting, let ...
1
vote
2answers
132 views

Is ISC BIND unaffected with OpenSSL Heartbleed bug?

There is a bug Heartbleed in OpenSSL. I built ISC BIND 9.9.5 with OpenSSL 1.0.1e enable. Should I re-built BIND with OpenSSL 1.0.1g?
-2
votes
1answer
336 views

Fedora 15 openssl heartbleed [closed]

I am running a fedora 15 2.6.32-042stab081.3 x64, I have OpenSSL 1.0.0j-fips 10 May 2012 which I understand to not be infected. However every test tool out there is reporting the site maybe ...
0
votes
1answer
144 views

Could Certificate Authorities have been compromised by the Heartbleed bug? [closed]

OpenSSL is widely used and was affected by the Heartbleed bug for years. A lot of services were impacted and everybody is trying to recover from this bug by updating there system, generating new ...
4
votes
1answer
2k views

Windows 2003 heartbleed bug openssl fix

As recommended by openssl.org I'm trying to update OpenSSL from 1.0.1e to 1.0.1g. Fixes for most linux distributions have already deployed, but, what should be done on windows? we are using win server ...
0
votes
0answers
71 views

How to better block phishing spam due to heartbleed?

I imagine it won't take long for spammers to recognize that Heartbleed is an ideal way to do phishing. I am thinking of ways to mitigate the phishing risk, I mean just this time for the heartbleed ...
0
votes
2answers
91 views

Possible Heartbleed Compromise recovery [duplicate]

I have a web-server, (complete with user account and payment system), that was vulnerable to the Heartbleed attack. What I'm wondering is: How can I detect if my server has been compromised? How do ...
4
votes
2answers
1k views

Is OpenVPN UDP vulnerable to heartbleed?

Is OpenVPN UDP vulnerable to heartbleed? I need to decide if I'm going to rebuild some servers, but they are very carefully firewalled; 1194/TCP is one of the firewalled ports (yay whitelist!). ...
2
votes
0answers
56 views

Still vulnerable to Heartbleed after updating and reboot [duplicate]

I'm on Ubuntu 12.04, I have updated openssl with the latest update : $ openssl version -a OpenSSL 1.0.1 14 Mar 2012 built on: Mon Apr 7 20:33:29 UTC 2014 And also updated libssl $ sudo apt-get ...
4
votes
4answers
6k views

Is there a way, to manually check for openssl CVE-2014-0160 vulnerability?

Is there a way for one to check some of internal services against CVE - CVE-2014-0160 (preferably using openssl CLI)? I CANNOT test everything just by using: Test your server for Heartbleed ...
8
votes
3answers
1k views

Do I have to update my snakeoil certificate after updating openssl (heartbleed)?

I just updated my debian wheezy server to the newest version of the openssl package which has the heartbleed bug fixed. I do support SSL on my server, but only with a snakeoil certificate. I was just ...
1
vote
2answers
628 views

How do I rotate an SSL Certificate as requested by AWS

Amazon AWS sent an email today that users using Elasic Load Balancing (ELB) service with SSL certificates should "Rotate" them for precaution (Heartbleed bug). How exactly do I rotate an ssl ...
0
votes
1answer
522 views

Heartbleed testing tools do not recognize reissued certificates (PositiveSSL Wildcard + Amazon ELB)

In response to the Heartbleed news, I have upgraded OpenSSL on my production server and am now trying to reissue the SSL certificate. I am using a PositiveSSL Wildcard certificate on an Amazon ELB. I ...
0
votes
1answer
151 views

App Engine, OpenSSL and Heartbleed

Has GAE ever used OpenSSL for its frontend servers? It’s quite interesting in the context of the Heartbleed security hole. It would be nice to get a confirmation from Google that no risks are present. ...
1
vote
1answer
2k views

Heartbleed flaw fix on Debian Wheezy [duplicate]

is there any 100% working method to update openssl to the non vulnerable version on Debian Wheezy. I do not want to upgrade the whole OS, nor would I like to install a non official package. Is there ...
2
votes
1answer
5k views

How to upgrade OpenSSL on CentOS 6.5 to protect against heartbleed? [duplicate]

When I go to run: root@vps [~]# yum update -y openssl I get: Loaded plugins: fastestmirror Loading mirror speeds from cached hostfile * base: mirror.beyondhosting.net * extras: ...
2
votes
2answers
719 views

How can I check if my embedded Linux's SSL is not affected by heartbleed, without relying on the version number?

There are a lot of embedded Linux device that are built on Linux, that are used exactly for security purposes, like gateways, if I check OpenSSL I get: openssl version -a gets -» OpenSSL 1.0.0k 5 ...
5
votes
1answer
700 views

How can I check if certificates generated with openssl are vulnerable to heartbleed

I am aware that you can show the version of openssl you are using by typing the following at the command line "openssl version". I created a certificate and a key some time ago with similar names to ...
1
vote
2answers
3k views

Is JBoss AS 6 vulnerable to Heartbleed?

We have a series of cloud servers running JBoss AS 6.1.0 community edition. We restrict access to these systems using SSL. We generate an SSL certificate for each server and then manually distribute ...
10
votes
1answer
305 views

How do we instruct our employees to protect themselves from Heartbleed? [duplicate]

Welcome to the world after heartbleed. We've patched our servers and are replacing our SSL certificates. But just because our servers are fixed, that doesn't mean that the rest of the internet is ...