Heartbleed bug: What you need to know

<div class="separator" style="clear: both; text-align: center;"> <a href="http://upload.wikimedia.org/wikipedia/commons/thumb/d/dc/Heartbleed.svg/411px-Heartbleed.svg.png" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><span style="font-family: Arial, Helvetica, sans-serif;"><img border="0" height="320" src="http://upload.wikimedia.org/wikipedia/commons/thumb/d/dc/Heartbleed.svg/411px-Heartbleed.svg.png" width="255" /></span></a></div> <span style="font-family: Arial, Helvetica, sans-serif;">The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library. This weakness allows stealing the information protected, under normal conditions, by the SSL/TLS encryption used to secure it.</span><br /> <span style="font-family: Arial, Helvetica, sans-serif;"><br /></span> <span style="font-family: Arial, Helvetica, sans-serif;">You are likely affected if you configured and run an SSL-enabled website, meaning that you can access it using the https:// prefix instead of http://. You will need to patch the libraries in your system and replace the certificates and keys that may have been compromised. Please notice that remote access using ssh is NOT affected.</span><br /> <span style="font-family: Arial, Helvetica, sans-serif;"><br /></span> <span style="font-family: Arial, Helvetica, sans-serif;">OpenSSL versions from 1.0.1 through 1.0.1f (inclusive) are vulnerable and make it possible to steal information, including everything from the encrypted content and to the secret key used for the encryption. The attack is also indetectable.</span><br /> <span style="font-family: Arial, Helvetica, sans-serif;"><br /></span> <span style="font-family: Arial, Helvetica, sans-serif;">This security issue has been described in detail on the following page:</span><br /> <a href="http://heartbleed.com/" target="_blank"><span style="font-family: Arial, Helvetica, sans-serif;">http://heartbleed.com/</span></a><br /> <span style="font-family: Arial, Helvetica, sans-serif;"><br /></span> <br /> <h2> <span style="font-family: Arial, Helvetica, sans-serif; font-size: large;">How about operating systems?</span></h2> <div> <div class="separator" style="clear: both; text-align: center;"> </div> <div style="background-color: white; box-sizing: border-box; color: #222222; line-height: 28.571430206298828px; margin-bottom: 10px;"> <span style="font-family: Arial, Helvetica, sans-serif;">Some operating system distributions that have shipped with potentially vulnerable OpenSSL version:</span></div> <ul style="background-color: white; box-sizing: border-box; color: #222222; line-height: 28.571430206298828px; margin-bottom: 10px; margin-top: 0px;"> <li style="box-sizing: border-box;"><span style="font-family: Arial, Helvetica, sans-serif;">Debian Wheezy (stable), OpenSSL 1.0.1e-2+deb7u4</span></li> </ul> <ul style="background-color: white; box-sizing: border-box; color: #222222; line-height: 28.571430206298828px; margin-bottom: 10px; margin-top: 0px;"> <li style="box-sizing: border-box;"><span style="font-family: Arial, Helvetica, sans-serif;">Ubuntu 12.04.4 LTS, OpenSSL 1.0.1-4ubuntu5.11</span></li> </ul> <ul style="background-color: white; box-sizing: border-box; color: #222222; line-height: 28.571430206298828px; margin-bottom: 10px; margin-top: 0px;"> <li style="box-sizing: border-box;"><span style="font-family: Arial, Helvetica, sans-serif;">CentOS 6.5, OpenSSL 1.0.1e-15</span></li> </ul> <ul style="background-color: white; box-sizing: border-box; color: #222222; line-height: 28.571430206298828px; margin-bottom: 10px; margin-top: 0px;"> <li style="box-sizing: border-box;"><span style="font-family: Arial, Helvetica, sans-serif;">Fedora 18, OpenSSL 1.0.1e-4</span></li> </ul> <ul style="background-color: white; box-sizing: border-box; color: #222222; line-height: 28.571430206298828px; margin-bottom: 10px; margin-top: 0px;"> <li style="box-sizing: border-box;"><span style="font-family: Arial, Helvetica, sans-serif;">OpenBSD 5.3 (OpenSSL 1.0.1c 10 May 2012) and 5.4 (OpenSSL 1.0.1c 10 May 2012)</span></li> </ul> <ul style="background-color: white; box-sizing: border-box; color: #222222; line-height: 28.571430206298828px; margin-bottom: 10px; margin-top: 0px;"> <li style="box-sizing: border-box;"><span style="font-family: Arial, Helvetica, sans-serif;">FreeBSD 10.0 - OpenSSL 1.0.1e 11 Feb 2013</span></li> </ul> <ul style="background-color: white; box-sizing: border-box; color: #222222; line-height: 28.571430206298828px; margin-bottom: 10px; margin-top: 0px;"> <li style="box-sizing: border-box;"><span style="font-family: Arial, Helvetica, sans-serif;">NetBSD 5.0.2 (OpenSSL 1.0.1e)</span></li> </ul> <ul style="background-color: white; box-sizing: border-box; color: #222222; line-height: 28.571430206298828px; margin-bottom: 10px; margin-top: 0px;"> <li style="box-sizing: border-box;"><span style="font-family: Arial, Helvetica, sans-serif;">OpenSUSE 12.2 (OpenSSL 1.0.1c)</span></li> </ul> <span style="font-family: Arial, Helvetica, sans-serif;">Operating system distribution with versions that are not vulnerable:</span><br /> <ul style="background-color: white; box-sizing: border-box; color: #222222; line-height: 28.571430206298828px; margin-bottom: 10px; margin-top: 0px;"> <li style="box-sizing: border-box;"><span style="font-family: Arial, Helvetica, sans-serif;">Debian Squeeze (oldstable), OpenSSL 0.9.8o-4squeeze14</span></li> </ul> <ul style="background-color: white; box-sizing: border-box; color: #222222; line-height: 28.571430206298828px; margin-bottom: 10px; margin-top: 0px;"> <li style="box-sizing: border-box;"><span style="font-family: Arial, Helvetica, sans-serif;">SUSE Linux Enterprise Server</span></li> </ul> <ul style="background-color: white; box-sizing: border-box; color: #222222; line-height: 28.571430206298828px; margin-bottom: 10px; margin-top: 0px;"> <li style="box-sizing: border-box;"><span style="font-family: Arial, Helvetica, sans-serif;">FreeBSD 8.4 - OpenSSL 0.9.8y 5 Feb 2013</span></li> </ul> <ul style="background-color: white; box-sizing: border-box; color: #222222; line-height: 28.571430206298828px; margin-bottom: 10px; margin-top: 0px;"> <li style="box-sizing: border-box;"><span style="font-family: Arial, Helvetica, sans-serif;">FreeBSD 9.2 - OpenSSL 0.9.8y 5 Feb 2013</span></li> </ul> <ul style="background-color: white; box-sizing: border-box; color: #222222; line-height: 28.571430206298828px; margin-bottom: 10px; margin-top: 0px;"> <li style="box-sizing: border-box;"><span style="font-family: Arial, Helvetica, sans-serif;">FreeBSD 10.0p1 - OpenSSL 1.0.1g (At 8 Apr 18:27:46 2014 UTC)</span></li> </ul> <ul style="background-color: white; box-sizing: border-box; color: #222222; line-height: 28.571430206298828px; margin-bottom: 10px; margin-top: 0px;"> <li style="box-sizing: border-box;"><span style="font-family: Arial, Helvetica, sans-serif;">FreeBSD Ports - OpenSSL 1.0.1g (At 7 Apr 21:46:40 2014 UTC)</span></li> </ul> </div> <h2> <span style="font-family: Arial, Helvetica, sans-serif; font-size: large;"> Detect if your machine is vulnerable.</span></h2> <div> <div style="background-color: white; line-height: 19.200000762939453px; margin-top: 0.75em; padding: 0px;"> <div class="separator" style="clear: both; text-align: center;"> <a href="http://upload.wikimedia.org/wikipedia/commons/thumb/c/cb/Heartbleed_bug_explained.svg/554px-Heartbleed_bug_explained.svg.png" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" height="180" src="http://upload.wikimedia.org/wikipedia/commons/thumb/c/cb/Heartbleed_bug_explained.svg/554px-Heartbleed_bug_explained.svg.png" width="320" /></a></div> <span style="font-family: Arial, Helvetica, sans-serif;">If you are running a web server with SSL enabled, you can test whether it is vulnerable with this tool:</span></div> <div style="background-color: white; line-height: 19.200000762939453px; margin-top: 0.75em; padding: 0px;"> <a href="https://filippo.io/Heartbleed/#ezadblog.my" rel="nofollow" target="_blank"><span style="font-family: Arial, Helvetica, sans-serif;">http://filippo.io/Heartbleed/</span></a></div> <div style="background-color: white; line-height: 19.200000762939453px; margin-top: 0.75em; padding: 0px;"> <span style="font-family: Arial, Helvetica, sans-serif;">Alternatively, to detect if your machine is vulnerable to this bug, please log into your servers and check the OpenSSL version by executing the  below command:</span></div> <pre style="background-color: #fefefe; border-left-color: rgb(170, 170, 170); border-left-style: solid; border-left-width: 4px; color: #777777; line-height: 19.200000762939453px; margin-left: 1em; margin-top: 0.75em; overflow: auto; padding: 0px 0px 0px 1em;"><span style="font-family: Arial, Helvetica, sans-serif;">openssl version -a</span></pre> <div style="background-color: white; line-height: 19.200000762939453px; margin: 0px; padding: 0px;"> </div> <div style="background-color: white; line-height: 19.200000762939453px; margin-top: 0.75em; padding: 0px;"> <span style="font-family: Arial, Helvetica, sans-serif;">If the version in the output is greater or <span style="color: red;"><strong>equal to "1.0.1" and lower or equal to "1.0.1f "</strong></span>, you may be affected. An example of an affected version would be:</span></div> <pre style="background-color: #fefefe; border-left-color: rgb(170, 170, 170); border-left-style: solid; border-left-width: 4px; color: #777777; line-height: 19.200000762939453px; margin-left: 1em; margin-top: 0.75em; overflow: auto; padding: 0px 0px 0px 1em;"><span style="font-family: Arial, Helvetica, sans-serif;">$> openssl version -a OpenSSL <span style="color: red;"><strong>1.0.1</strong></span> 14 Mar 2012 built on: Wed Jan  8 20:45:51 UTC 2014 platform: debian-amd64 </span></pre> <div style="background-color: white; line-height: 19.200000762939453px; margin: 0px; padding: 0px;"> </div> <div style="background-color: white; line-height: 19.200000762939453px; margin-top: 0.75em; padding: 0px;"> <span style="font-family: Arial, Helvetica, sans-serif;">Please note the version mentioned: "1.0.1", which is in the range of affected versions. Another detail to check is the "built on" information:</span></div> <pre style="background-color: #fefefe; border-left-color: rgb(170, 170, 170); border-left-style: solid; border-left-width: 4px; color: #777777; line-height: 19.200000762939453px; margin-left: 1em; margin-top: 0.75em; overflow: auto; padding: 0px 0px 0px 1em;"><span style="font-family: Arial, Helvetica, sans-serif;">$> openssl version -a ... built on: <span style="color: red;"><strong>Wed Jan  8 20:45:51 UTC 2014</strong></span> ...</span></pre> <div style="background-color: white; line-height: 19.200000762939453px; margin-top: 0.75em; padding: 0px;"> <span style="font-family: Arial, Helvetica, sans-serif;"><br /></span></div> <div style="background-color: white; line-height: 19.200000762939453px; margin-top: 0.75em; padding: 0px;"> <span style="font-family: Arial, Helvetica, sans-serif;">Some Linux distributions have provided security patches that fix the vulnerability without upgrading OpenSSL. The "built on:" date should be <span style="color: green;"><strong>newer or equal to April 2014</strong> </span>to consider it updated. An example of patched OpenSSL version would be:</span></div> <div style="background-color: white; line-height: 19.200000762939453px; margin: 0px; padding: 0px;"> <pre style="background-color: #fefefe; border-left-color: rgb(170, 170, 170); border-left-style: solid; border-left-width: 4px; color: #777777; margin-left: 1em; margin-top: 0.75em; overflow: auto; padding: 0px 0px 0px 1em;"><span style="font-family: Arial, Helvetica, sans-serif;">/usr/bin/openssl version -a OpenSSL <strong>1.0.1</strong> 14 Mar 2012 built on: <span style="color: green;"><strong>Mon Apr 7 20:33:29 UTC 2014</strong></span> platform: debian-amd64 </span></pre> </div> <div style="background-color: white; line-height: 19.200000762939453px; margin: 0px; padding: 0px;"> </div> <div style="background-color: white; line-height: 19.200000762939453px; margin: 0px; padding: 0px;"> <span style="font-family: Arial, Helvetica, sans-serif;">Where the OpenSSL is in the vulnerable range but it was patched on April 2014:</span></div> <div style="background-color: white; line-height: 19.200000762939453px; margin: 0px; padding: 0px;"> </div> <div style="background-color: white; line-height: 19.200000762939453px; margin: 0px; padding: 0px;"> <span style="font-family: Arial, Helvetica, sans-serif;">Another non-vulnerable version (this one, easier to identify) will look like:</span></div> <div style="background-color: white; line-height: 19.200000762939453px; margin: 0px; padding: 0px;"> <pre style="background-color: #fefefe; border-left-color: rgb(170, 170, 170); border-left-style: solid; border-left-width: 4px; color: #777777; margin-left: 1em; margin-top: 0.75em; overflow: auto; padding: 0px 0px 0px 1em;"><span style="font-family: Arial, Helvetica, sans-serif;">openssl version -a OpenSSL <strong><span style="color: green;">1.0.1g</span></strong> 7 Apr 2014 built on: Tue Apr  8 09:07:07 CEST 2014 platform: linux-x86_64 </span></pre> </div> <div style="background-color: white; margin: 0px; padding: 0px;"> <div style="line-height: 19.200000762939453px; margin: 0px; padding: 0px;"> </div> <div style="margin: 0px; padding: 0px;"> <div style="line-height: 19.200000762939453px;"> <span style="font-family: Arial, Helvetica, sans-serif;">Where the version is greater than "1.0.1f", so it is safe. It also shows it was updated in April 2014. This is the output you will get if you use our patch installer to update your SSL version</span></div> <div style="line-height: 19.200000762939453px;"> <span style="font-family: Arial, Helvetica, sans-serif;"><br /></span></div> <h2> <span style="font-family: Arial, Helvetica, sans-serif; font-size: large;"><span style="line-height: 19.200000762939453px;">Update the system OpenSSL version</span></span></h2> <div> <div style="margin: 0px; padding: 0px;"> <div id="section_7" style="margin: 0px; padding: 0px;"> <div style="line-height: 19.200000762939453px; margin: 0px; padding: 0px;"> <span style="font-family: Arial, Helvetica, sans-serif;">The procedure to update the system OpenSSL package will depend on you Linux distribution:</span></div> <div style="line-height: 19.200000762939453px; margin: 0px; padding: 0px;"> </div> <div style="line-height: 19.200000762939453px; margin: 0px; padding: 0px;"> <strong><span style="font-family: Arial, Helvetica, sans-serif;"> apt-based systems: Ubuntu, Debian...</span></strong></div> <div style="line-height: 19.200000762939453px; margin: 0px; padding: 0px;"> </div> <pre style="background-color: #fefefe; border-left-color: rgb(170, 170, 170); border-left-style: solid; border-left-width: 4px; color: #777777; line-height: 19.200000762939453px; margin-left: 1em; margin-top: 0.75em; overflow: auto; padding: 0px 0px 0px 1em;"><span style="font-family: Arial, Helvetica, sans-serif;">sudo apt-get update sudo apt-get install -y libssl1.0.0 openssl</span></pre> <div style="line-height: 19.200000762939453px; margin: 0px; padding: 0px;"> </div> <div style="line-height: 19.200000762939453px; margin: 0px; padding: 0px;"> <span style="font-family: Arial, Helvetica, sans-serif;">And then check that the version was updated (or patched, with a recent "built on" date):</span></div> <div style="line-height: 19.200000762939453px; margin: 0px; padding: 0px;"> </div> <pre style="background-color: #fefefe; border-left-color: rgb(170, 170, 170); border-left-style: solid; border-left-width: 4px; color: #777777; line-height: 19.200000762939453px; margin-left: 1em; margin-top: 0.75em; overflow: auto; padding: 0px 0px 0px 1em;"><span style="font-family: Arial, Helvetica, sans-serif;">/usr/bin/openssl version -a OpenSSL 1.0.1 14 Mar 2012 built on: <span style="color: green;"><strong>Mon Apr 7 20:33:29 UTC 2014</strong></span> ...</span></pre> <div style="line-height: 19.200000762939453px; margin: 0px; padding: 0px;"> </div> <div style="line-height: 19.200000762939453px; margin: 0px; padding: 0px;"> <span style="font-family: Arial, Helvetica, sans-serif;">You will also need to restart any service using libssl. To check the list of those services, you could use the below command:</span></div> <div style="line-height: 19.200000762939453px; margin: 0px; padding: 0px;"> </div> <pre style="background-color: #fefefe; border-left-color: rgb(170, 170, 170); border-left-style: solid; border-left-width: 4px; color: #777777; line-height: 19.200000762939453px; margin-left: 1em; margin-top: 0.75em; overflow: auto; padding: 0px 0px 0px 1em;"><span style="font-family: Arial, Helvetica, sans-serif;">sudo lsof -n | grep ssl | grep DEL vsftpd 479 root DEL REG 202,1 394910 /lib/x86_64-linux-gnu/libssl.so.1.0.0 monit 1254 root DEL REG 202,1 394910 /lib/x86_64-linux-gnu/libssl.so.1.0.0</span></pre> <div style="line-height: 19.200000762939453px; margin: 0px; padding: 0px;"> </div> <div style="line-height: 19.200000762939453px; margin: 0px; padding: 0px;"> <span style="font-family: Arial, Helvetica, sans-serif;">And then restart the services (depending on your specific system):</span></div> <div style="line-height: 19.200000762939453px; margin: 0px; padding: 0px;"> </div> <pre style="background-color: #fefefe; border-left-color: rgb(170, 170, 170); border-left-style: solid; border-left-width: 4px; color: #777777; line-height: 19.200000762939453px; margin-left: 1em; margin-top: 0.75em; overflow: auto; padding: 0px 0px 0px 1em;"><span style="font-family: Arial, Helvetica, sans-serif;">sudo /etc/init.d/monit restart sudo /etc/init.d/vsftpd restart</span></pre> <div style="line-height: 19.200000762939453px; margin: 0px; padding: 0px;"> </div> <div style="line-height: 19.200000762939453px; margin: 0px; padding: 0px;"> <div style="margin-top: 0.75em; padding: 0px;"> </div> <div style="margin: 0px; padding: 0px;"> </div> </div> <div style="line-height: 19.200000762939453px; margin: 0px; padding: 0px;"> <strong><span style="font-family: Arial, Helvetica, sans-serif;">yum-base systems: RedHat, CentOS, Fedora...</span></strong></div> <div style="line-height: 19.200000762939453px; margin: 0px; padding: 0px;"> </div> <pre style="background-color: #fefefe; border-left-color: rgb(170, 170, 170); border-left-style: solid; border-left-width: 4px; color: #777777; line-height: 19.200000762939453px; margin-left: 1em; margin-top: 0.75em; overflow: auto; padding: 0px 0px 0px 1em;"><span style="font-family: Arial, Helvetica, sans-serif;">sudo yum -y update openssl</span></pre> <div style="line-height: 19.200000762939453px; margin: 0px; padding: 0px;"> </div> <div style="line-height: 19.200000762939453px; margin: 0px; padding: 0px;"> <span style="font-family: Arial, Helvetica, sans-serif;">And then check that the version was updated (or patched, with a recent "built on" date):</span></div> <div style="line-height: 19.200000762939453px; margin: 0px; padding: 0px;"> </div> <pre style="background-color: #fefefe; border-left-color: rgb(170, 170, 170); border-left-style: solid; border-left-width: 4px; color: #777777; line-height: 19.200000762939453px; margin-left: 1em; margin-top: 0.75em; overflow: auto; padding: 0px 0px 0px 1em;"><span style="font-family: Arial, Helvetica, sans-serif;">/usr/bin/openssl version -a OpenSSL 1.0.1 14 Mar 2012 built on: <span style="color: green;"><strong>Mon Apr 7 20:33:29 UTC 2014</strong></span> ...</span></pre> <div style="line-height: 19.200000762939453px; margin: 0px; padding: 0px;"> </div> <div style="line-height: 19.200000762939453px; margin: 0px; padding: 0px;"> <span style="font-family: Arial, Helvetica, sans-serif;">You will also need to restart any service using libssl. To check the list of those services, you could use the below command:</span></div> <div style="line-height: 19.200000762939453px; margin: 0px; padding: 0px;"> </div> <pre style="background-color: #fefefe; border-left-color: rgb(170, 170, 170); border-left-style: solid; border-left-width: 4px; color: #777777; line-height: 19.200000762939453px; margin-left: 1em; margin-top: 0.75em; overflow: auto; padding: 0px 0px 0px 1em;"><span style="font-family: Arial, Helvetica, sans-serif;">sudo lsof -n | grep ssl | grep DEL vsftpd 479 root DEL REG 202,1 394910 /lib/x86_64-linux-gnu/libssl.so.1.0.0 monit 1254 root DEL REG 202,1 394910 /lib/x86_64-linux-gnu/libssl.so.1.0.0</span></pre> <div style="line-height: 19.200000762939453px; margin: 0px; padding: 0px;"> </div> <div style="line-height: 19.200000762939453px; margin: 0px; padding: 0px;"> <span style="font-family: Arial, Helvetica, sans-serif;">And then restart the services (depending on your specific system):</span></div> <div style="line-height: 19.200000762939453px; margin: 0px; padding: 0px;"> </div> <pre style="background-color: #fefefe; border-left-color: rgb(170, 170, 170); border-left-style: solid; border-left-width: 4px; color: #777777; line-height: 19.200000762939453px; margin-left: 1em; margin-top: 0.75em; overflow: auto; padding: 0px 0px 0px 1em;"><span style="font-family: Arial, Helvetica, sans-serif;">sudo /etc/init.d/monit restart sudo /etc/init.d/vsftpd restart </span></pre> <div style="line-height: 19.200000762939453px;"> <span style="font-family: Arial, Helvetica, sans-serif;"><br /></span></div> <h2> <span style="font-family: Arial, Helvetica, sans-serif; font-size: large;"><span style="line-height: 19.200000762939453px;">Next Steps</span></span></h2> <div> <div style="line-height: 19.200000762939453px; margin-top: 0.75em; padding: 0px;"> <strong><span style="font-family: Arial, Helvetica, sans-serif;">First, after apllying the patches above, double-check whether your web site is ok now using this tool:</span></strong></div> <div style="line-height: 19.200000762939453px; margin-top: 0.75em; padding: 0px;"> <a href="https://filippo.io/Heartbleed/#ezadblog.my" rel="nofollow" target="_blank"><span style="font-family: Arial, Helvetica, sans-serif;">http://filippo.io/Heartbleed</span></a></div> <div style="margin-top: 0.75em; padding: 0px;"> <span style="line-height: 19.200000762939453px;"><span style="font-family: Arial, Helvetica, sans-serif;">The vulnerability allows an attacker to steal you private keys, which would allow it to decrypt any information, as well as impersonating your server so it is advised to revoke the compromised keys and reissuing and redistributing new ones.</span></span></div> <div style="margin-top: 0.75em; padding: 0px;"> <br /></div> <div style="margin-top: 0.75em; padding: 0px;"> <span style="line-height: 19.200000762939453px;"><span style="font-family: Arial, Helvetica, sans-serif;">This is only necessary if you already configured HTTPS with your own certificate. In this case regenerate new certificates and configure them again in your server.</span></span></div> </div> </div> </div> <div style="font-family: 'Lucida Grande', Verdana, Arial, sans-serif; font-size: 12px; line-height: 19.200000762939453px; margin: 0px; padding: 0px;"> </div> </div> </div> </div> </div>

Heartbleed bug: What you need to know

The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library. This weakness allows stealing the inf...

Read more »