I've updated my Ubuntu server to use OpenSSL 1.0.1g and when I run sudo openssl version -a I get OpenSSL 1.0.1g 7 Apr 2014 built on: Sat Apr 19 14:15:45 UTC 2014 platform: linux-elf

However, sites like https://filippo.io/Heartbleed/ are still returning my site as vulnerable to Heartbleed. I have restarted the server, not sure what else I have to do.

Is there a way to find any services that are currently running and are vulnerable to the Hearbleed security issue?

Anyone else having this problem?

  • 1
    What are you using to terminate SSL? Apache, nginx, pound, stunnel, etc.? Could it be that you have a custom build of one of these which is statically linked? – chrskly Apr 19 '14 at 14:52
  • 1
    Why did you build your own instead of using the Ubuntu-provided security update? – Michael Hampton Apr 19 '14 at 15:37
  • Did you also update libssl? – EEAA Apr 19 '14 at 17:30

I can think of a few problems that would cause this:

  1. Possibly some form of a caching issue, not sure if you have any caching enabled on your sites, but I would look there.
  2. Apache being built on an older OpenSSL version. In this case you need to recompile it, or depending on OS use yum/apt-get to remove it and reinstall it.
  3. Did you remember to restart Apache after making the change to OpenSSL?

If you provide more details I may be able to assist further.

  • #2 It was running an old version of Apache that wasn't recognizing the updated OpenSSL version. All is set now. Thanks :) – Brian Weinreich Apr 20 '14 at 19:42

Heartbleed can be exploited if you have a service running, that is actively using a vulnerable openssl version.

This could be a service providing https. After fixing the openssl-stack (like you tried to do) and after verifying the service (like you did) the last step, after you are not vulnerable any longer, is to treat all involved keys as compromised.

That is: Mark them as compromised and get new ones.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.