We're running Ubuntu 12.04.2 LTS and nginx 1.4.0 and openssl 1.0.1. We just patched openssl to deal with CVE-2014-0224 vulnerabilities, and restarted nginx, but scanners still think we are vulnerable to CVE-2014-0224. Scanners include WhiteHat, https://access.redhat.com/labs/ccsinjectiontest/ , and the Python script from here: http://www.tripwire.com/state-of-security/incident-detection/detection-script-for-cve-2014-0224-openssl-cipher-change-spec-injection/ . Anyone come across something like this? We've checked nginx and it is dynamically linking and we are certain the we have the right version of openssl installed now. We've been through the postings at nist.gov and ubuntu.com and nginx.com.
4
-
1Exactly what did you do?– Michael HamptonJun 10, 2014 at 23:38
-
Sorry. Never mind. We applied the correct update and restarted nginx. A day or two after, WhiteHat complained that we were vulnerable. After racking our brains, we just restarted nginx again today and all is well. We did no other software changes in the meantime. Unsatisfying, but it's now fixed.– Nick PilchJun 11, 2014 at 4:00
-
We've just seen the same thing with 3 CentOS 6 servers running apache. Upgraded openssl, checked via "rpm -q --changelog openssl | grep CVE-2014-0224" confirming it has the fix, and yet the above tools still say it's vulnerable– jhaarJun 13, 2014 at 11:12
-
An Ops engineer suggested service stop followed by service start after verifying that all processes have died (rather than service restart). We also did reboot a couple of machines and that fixed it too.– Nick PilchJun 13, 2014 at 15:12
Add a comment
|