Tag Info

New answers tagged

5

There are two things that may be going on here: A simple "./configure; make; make install" will by default place the shared libraries in /usr/local/lib. The system-installed libraries, however, will be in /usr/lib, which comes earlier in the library search path. Unless you remove the system-installed version of OpenSSL, the vulnerable version won't be ...


6

What server software is being used? Despite the OpenSSL binary being vulnerable, an installed web server from an OS package is likely to be using a library version that is not vulnerable. The simplest way to get a vulnerable listener running will be openssl s_server - if you need a full web server to be vulnerable, you'll likely need to compile against the ...


0

A way to know this is to have a look at the Ubuntu Security Notices (USN) which are released each time a vulnerability is fixed in Ubuntu. In such case, the release of the package in which it is fixed is written. For instance, for heartbleed, the USN was the USN-2165-1 (http://www.ubuntu.com/usn/usn-2165-1/) which states that it has been fixed in ...


2

The actual version of affected OpenSSL version in Ubuntu 12.04LTS is 1.0.1-4ubuntu5.11 and current version is 1.0.1-4ubuntu5.21 (the number at the end matters here). It's been patched a few times since and should not be affected by heartbleed bug. Here's a link from which you can see affected version numbers in different distributions: ...


0

As well as Tobi's suggestion about openssl versions, you may not be installing the libraries into the correct locations. If you just run "./configure; make; make install" it will install into /usr/local/lib by default, for example. Even if you set the prefix properly, you might still be installing into /usr/lib/ rather than /usr/lib64, and ldconfig might ...


1

the 'problem' is that your ngnix is linked against a particular verion of libssl (libssl.so.10) ... your newly compiled libssl has a different version. Run ldd `which openssl` to see which version it is ... In order for ngnix to use the new version of libssl you have to recompile ngnix as well. Another option you have is to compile ...



Top 50 recent answers are included