Questions tagged [heartbleed]
The Heartbleed bug is a vulnerability in OpenSSL's TLS implementation. The CVE ID for this issue is CVE-2014-0160
63
questions
88
votes
8
answers
47k
views
Heartbleed: how to reliably and portably check the OpenSSL version?
I was looking at a reliable and portable way to check the OpenSSL version on GNU/Linux and other systems, so users can easily discover if they should upgrade their SSL because of the Heartbleed bug.
...
CommunityBot
- 1
0
votes
1
answer
664
views
apache taking old openssl libraries when doing apachectl graceful
Due to heartbleed vulnerability I have recompiled apache with non vulnerable latest openssl(I had to keep old vulnerable openssl due to some dependency problem). It is running fine and when doing ...
- 1,249
28
votes
4
answers
50k
views
How do I check if my SSL certificates have been revoked
The recent discovery of the heartbleed vulnerability has prompted certificate authorities to re-issue certificates.
I have two certificates that were generated before the heartbleed vulnerability ...
- 646
6
votes
1
answer
5k
views
Why do I get different openssl versions?
I'm trying to check if I running the latest OpenSSL version, my main concern is the heartbleed bug.
I tried 2 commands:
openssl version
yum info openssl
openssl version output
OpenSSL 1.0.1e-...
- 80.3k
9
votes
2
answers
4k
views
How to install a vulnerable version of OpenSSL on a Linux server?
I'd like to compile and install a Heartbleed-vulnerable OpenSSL version on a server I'm setting up for a team web security challenge (since these are not available for install from Ubuntu's repository ...
- 668
0
votes
2
answers
355
views
Does Ubuntu 12.04LTS have the OpenSSL heartbleed fix?
Only OpenSSL 1.0.1f or later has the fix for the heartbleed exploit. So does Ubuntu 12.04LTS have the fix? We need to use 12.04LTS for reasons I won't go into, and we can't upgrade.
According to this ...
- 638
-1
votes
2
answers
973
views
Openssl upgrade from source [closed]
I have upgraded the openssl version on my server to the latest version of openssl but the libraries that the reverse proxy server is using is pointing to .
strings /usr/lib64/libssl.so.10 | grep "^...
- 1,892
1
vote
1
answer
240
views
App Engine, OpenSSL and Heartbleed
Has GAE ever used OpenSSL for its frontend servers? It’s quite interesting in the context of the Heartbleed security hole. It would be nice to get a confirmation from Google that no risks are present.
google-app-engine
4
votes
2
answers
7k
views
debian wheezy, heartbleed, openssl refuses to update
I am having a strange problem, my system is exposed to heartbleed, and I am trying to fix it by using:
apt-get clean,
apt-get update
and
apt-get upgrade openssl
but the response is:
Reading ...
CommunityBot
- 1
2
votes
1
answer
736
views
HeartBleed Openssl update Redhat Enterprise server 6.3
I already update using yum update openssl but still my server is vulnerable.
Tried grep 'libssl.*(deleted)' /proc/*/maps and no result as I already restarted the server.
Yet, it is still vulnerable.
$...
- 99.6k
0
votes
0
answers
177
views
Updating openssl to fix heartbleed bug tries to remove redis-server
I am trying to fix openssl heartbleed bug on my server. I read that I can update the openssl version with the following command:
sudo apt-get install openssl libssl1.0.0
But when i try to run this ...
- 101
0
votes
1
answer
638
views
Will tcnative-1.dll version 1.1.30 work with tomcat 7.0.29 without any issues?
In order to fix the Heartbleed vulnerability a new release of the tomcat java native libraries is being created. Will this release work with older versions of Tomcat 7 such as 7.0.29, or will this ...
- 146
0
votes
2
answers
2k
views
Which versions of win32 tcnative-1.dll are succeptible to heartbleed
We are trying to determine our window of vulnerability for Heartbleed. Does anyone have an idea of how to determine which version of OpenSSL was used to build a given Tomcat Native DLL?
Our server ...
- 146
0
votes
1
answer
168
views
Was my server vulnerable to heartbleed if TLS has been disabled?
Was my server vulnerable to heartbleed if TLS has been disabled in the past?
In apaches vhost configuration the parameter sslCipherSuite contains only SSLv2 afaik this doesn't contain TLS.
- 234
0
votes
0
answers
30
views
Should I completely rebuild my server due to Heartbleed? [duplicate]
I have a CentOS 6.5 VPS server...
$ uname -a
Linux mary 3.14.4-x86_64-linode40 #1 SMP Tue May 13 12:25:05 EDT 2014 \
x86_64 x86_64 x86_64 GNU/Linux
When the news about the Heartbleed ...
- 2,449
-1
votes
1
answer
242
views
Heartbleed not fixed by Openssl and server upgrade
I have inherited a server in one of our Dev environments and found out straight away that it was not patched when the heartbleed was discovered.
Now, I've upgraded it - including all SSL libraries ...
- 3,477
-1
votes
1
answer
118
views
Heartbleed - Centos 6.5, Apache - should I recreate pair of default certificate and key [duplicate]
I am using Centos 6.5, Apache 2.2.15 with SSL. Due to heartbleed I have updated openssl to release 16.el6_5.7 and I have restarted the httpd service.
I am using default Apache certificate and key:
*/...
CommunityBot
- 1
5
votes
2
answers
1k
views
Upgrading SSL library does not fix heartbleed
I have just upgraded the openssl library on my Ubuntu 12.04 server to fix the heartbleed bug. Here's the output that I get for the "openssl version -a" command:
OpenSSL 1.0.0g 18 Jan 2012
built on: ...
CommunityBot
- 1
1
vote
1
answer
284
views
Can Heartbleed cause a server to crash?
I know about the basic Heartbleed vulnerability and it's consequences and cause. However, I recently read that Heartbleed may cause a server to crash. I am wondering if this statement is true and if ...
- 134k
204
votes
9
answers
33k
views
Heartbleed: What is it and what are options to mitigate it?
This is a Canonical Question about understanding and remediating the Heartbleed security issue.
What exactly is CVE-2014-0160 AKA "Heartbleed"? What is the cause, what OSs and versions of OpenSSL are ...
CommunityBot
- 1
10
votes
1
answer
3k
views
I am still running Ubuntu 13.04, how should I react to the Heartbleed Bug? [duplicate]
I know that 13.04 is affected (or at least my installation is) because of the OpenSSL version currently installed. However, after running
sudo apt-get update
sudo apt-get upgrade
I checked my ...
CommunityBot
- 1
0
votes
2
answers
1k
views
Verify OpenVPN is no longer vulnerable to Heartbleed
As you may know, OpenVPN is vulnerable to the heartbleed attack. However, I can't find any guide online on how to fix it. The only source I've found is this:
http://community.openvpn.net/openvpn/wiki/...
- 39.7k
1
vote
1
answer
87
views
Heartbleed self-test for mailserver
The internet is now inundated by sites like this:
https://ssl-tools.net/heartbleed-test
Which is great, but these then immediately publish the vulnerable domains. I have a number of private ...
- 303
-4
votes
1
answer
134
views
Heartbleed: What if OpenSSL has been patched but SSL certs not yet rekeyed? [duplicate]
Does anyone know what entry point a hacker could have if a sever's OpenSSL has been patched but a site's SSL certs have not yet been rekeyed?
Thanks!
- 231
0
votes
2
answers
167
views
I have OpenSSL 1.0.1g but my site is still vulnerable?
I've updated my Ubuntu server to use OpenSSL 1.0.1g and when I run sudo openssl version -a I get OpenSSL 1.0.1g 7 Apr 2014
built on: Sat Apr 19 14:15:45 UTC 2014
platform: linux-elf
However, sites ...
- 7,745
1
vote
3
answers
238
views
Open SSL - Is my ubuntu really secure now after dist-upgrade?
I am running a Ubuntu 12.04 server and I just updated the server with (and rebooted afterwards)
sudo apt-get dist-upgrade
Now the open SSL version sais, it is build on 7 Apr 2014 what is good, but ...
CommunityBot
- 1
2
votes
1
answer
147
views
Switch the SSL provider after Heartbleed bug instead of revoking
I have a question regarding the Heartbleed problem and the SSL certificates. About Heartbleed many people say that admins should revoke their certificates and get new ones. I got my SSL certs from ...
CommunityBot
- 1
12
votes
1
answer
25k
views
Command line tool for fetching and analyzing SSL certificate
Following the heartbleed vulnerability in openSSL, all the SSH certificate on our servers were re-issued and re-installed.
Since it is likely that we've missed something on a server (for example, ...
CommunityBot
- 1
0
votes
1
answer
1k
views
OpenSSH and heartbleed? [duplicate]
I just updated a Debian Wheezy server for the first time today, after the heartbleed bug. OpenSSL is not installed on this server, so I thought the server was not affected, and therefore it was put on ...
- 110k
9
votes
1
answer
326
views
How do we instruct our employees to protect themselves from Heartbleed? [duplicate]
Welcome to the world after heartbleed. We've patched our servers and are replacing our SSL certificates. But just because our servers are fixed, that doesn't mean that the rest of the internet is ...
- 675
1
vote
1
answer
354
views
Can't upgrade Ubuntu 12.04.4 LTS to fix Heartbleed - Errors with nagios-nrpe-server and bind9
an anyone help? I am trying to upgrade but a get error messages about nagios-nrpe-server and bind.
Here is the console output:
>apt-get upgrade
Reading package lists... Done
Building dependency ...
- 360
1
vote
1
answer
8k
views
How to disable SSL-VPN on FortiOS 5.0
Hearbleed issue.
Must disable SSL-VPN.
I wasnt able to find it in the GUI.
Might there happen to be a CLI command?
- 649
4
votes
2
answers
4k
views
Server still vulnerable to HeartBleed after Openssl update
On a Centos 6.5 Minimal install, I have compiled Apache, PHP, and rpm installed Percona.
After updating OpenSSL days ago, my site that uses SSL on this server is vulnerable to Heartbleed somehow.
...
CommunityBot
- 1
0
votes
2
answers
316
views
Openssl heartbleed update not working with compiled Apache 2.4.7
We are still having heartbleed issues with one of our servers. We did the update with yum and restarted apache and any service that was using the vulnerable version of openssl. When we test our site ...
- 315
3
votes
1
answer
3k
views
Windows 2003 heartbleed bug openssl fix
As recommended by openssl.org I'm trying to update OpenSSL from 1.0.1e to 1.0.1g. Fixes for most linux distributions have already deployed, but, what should be done on windows? we are using win server ...
- 31
-1
votes
2
answers
527
views
Upgrade to secure openssl fails
Upgrade to secure openssl fails
Method:
have in /etc/apt/sources.list:
deb http://security.debian.org/ wheezy/updates main contrib non-free
Then do:
apt-get update
apt-cache policy openssl
apt-...
- 248k
2
votes
1
answer
124
views
How to reset self-signed keys that allow remote shell access to server in (Debian) linux
This is not something I've ever had to do before, and in light of the heartbleed bug I've been looking for a guide of how to do it properly, but all I can find are guides on how to log into a server ...
- 110k
0
votes
2
answers
140
views
Is the danger of the heartbleed bug worse than using non-ssl connections?
Trying to understand everything while reading http://heartbleed.com/
This sentence Leaked secret keys allows the attacker to decrypt any past and future traffic to the protected services and to ...
- 139
28
votes
8
answers
19k
views
My server is still vulnerable to heartbleed even after I update OpenSSL
I have an Ubuntu 12.04 server. I have updated the OpenSSL package in order to fix the heartbleed vulnerability. But I am still vulnerable even, even though I have restarted the web server, and even ...
CommunityBot
- 1
-1
votes
2
answers
219
views
Is a server running iis with a certificate issued by godaddy vulnerable to heartbleed [closed]
Is a server running IIS that is hosted by rackspace but using an SSL certificate issued by godaddy vulnerable to heartbleed?
Since it seemed that somebody thought this was worthy of down-voting, let ...
CommunityBot
- 1
2
votes
1
answer
578
views
Heartbleed vulnerability when SSL provided by unaffected servers?
*I'd like to ask about two scenarios where a vulnerable version of OpenSSL is installed on a server, but that server is not providing SSL services.
Scenario 1: I have an SSL certificate installed on ...
- 123
65
votes
6
answers
13k
views
Heartbleed: are services other than HTTPS affected?
The OpenSSL 'heartbleed' vulnerability (CVE-2014-0160) affects webservers serving HTTPS. Other services also use OpenSSL. Are these services also vulnerable to heartbleed-like data leakage?
I'm ...
CommunityBot
- 1
1
vote
2
answers
178
views
Is ISC BIND unaffected with OpenSSL Heartbleed bug?
There is a bug Heartbleed in OpenSSL. I built ISC BIND 9.9.5 with OpenSSL 1.0.1e enable. Should I re-built BIND with OpenSSL 1.0.1g?
CommunityBot
- 1
4
votes
2
answers
2k
views
Is OpenVPN UDP vulnerable to heartbleed?
Is OpenVPN UDP vulnerable to heartbleed?
I need to decide if I'm going to rebuild some servers, but they are very carefully firewalled; 1194/TCP is one of the firewalled ports (yay whitelist!).
...
CommunityBot
- 1
-2
votes
1
answer
631
views
Fedora 15 openssl heartbleed [closed]
I am running a fedora 15 2.6.32-042stab081.3 x64, I have OpenSSL 1.0.0j-fips 10 May 2012 which I understand to not be infected.
However every test tool out there is reporting the site maybe ...
CommunityBot
- 1
1
vote
2
answers
2k
views
How do I rotate an SSL Certificate as requested by AWS
Amazon AWS sent an email today that users using Elasic Load Balancing (ELB) service with SSL certificates should "Rotate" them for precaution (Heartbleed bug).
How exactly do I rotate an ssl ...
- 121
0
votes
1
answer
163
views
Could Certificate Authorities have been compromised by the Heartbleed bug? [closed]
OpenSSL is widely used and was affected by the Heartbleed bug for years.
A lot of services were impacted and everybody is trying to recover from this bug by updating there system, generating new ...
- 110k
5
votes
4
answers
17k
views
Is there a way, to manually check for openssl CVE-2014-0160 vulnerability?
Is there a way for one to check some of internal services against CVE - CVE-2014-0160 (preferably using openssl CLI)?
I CANNOT test everything just by using: Test your server for Heartbleed (CVE-2014-...
CommunityBot
- 1
8
votes
3
answers
2k
views
Do I have to update my snakeoil certificate after updating openssl (heartbleed)?
I just updated my debian wheezy server to the newest version of the openssl package which has the heartbleed bug fixed.
I do support SSL on my server, but only with a snakeoil certificate.
I was just ...
CommunityBot
- 1
0
votes
0
answers
95
views
How to better block phishing spam due to heartbleed?
I imagine it won't take long for spammers to recognize that Heartbleed is an ideal way to do phishing. I am thinking of ways to mitigate the phishing risk, I mean just this time for the heartbleed bug,...
- 135