Mostra notizie nelle discussioni
  • Avatar
    ☺
    Scritto da
    ::1
    il 2014-04-08 08:28:21.0 alle 2014-04-08 08:28:21.0
    Trollate totali: 12321
    Heartbleed Bug - openssl CVE-2014-0160
    http://www.openssl.org/news/secadv_20140407.txt
    http://heartbleed.com/
    Young professional woman and busy mom.
    • Avatar
      Scritto da
      Non Autenticato
      il 2014-04-08 10:07:18.0 alle 2014-04-08 10:07:18.0
      Re: Heartbleed Bug - openssl CVE-2014-0160
      Scritto da: ::1
      > http://www.openssl.org/news/secadv_20140407.txt
      > http://heartbleed.com/

      Based on the date displayed by your version of OpenSSL, it seems you are seeing the full version displayed there.

      Open SSL 1.0.1 was released on March 14th, 2012. 1.0.1a was released on April 19th of 2012.

      So, I'm going to go ahead and assert that openssl version -a is the proper, cross-distro way to display the full version of OpenSSL that's installed on the system. It seems to work for all the Linux distros I have access to, and is the method suggested in the help.ubuntu.com OpenSSL documentation, as well. Ubuntu LTS 12.04 shipped with vanilla OpenSSL v1.0.1, which is the version that looks like an abbreviated version, on account of not having a letter following it.

      Having said that, it appears that there is a major bug in Ubuntu (or how they package OpenSSL), in that openssl version -a continues to return the original 1.0.1 version from March 14, 2012, regardless of whether or not OpenSSL has been upgraded to any of the newer versions. And, as with most things when it rains, it pours. Ubuntu is not the only major distro in the dubious habit of backporting updates into OpenSSL (or other packages), rater than relying on the upstream updates and version numbering that everyone recognizes.

      For example, on Debian, the fixed version displays a version number of 1.0.1e-2+deb7u5, because rather than respecting the upstream versioning scheme, they decided to do their own stupid thing instead.

      As a result, at this time, there is no reliable, portable way to check SSL versions across Linux distributions, because they all use their own backported patches and updates with different version numbering schemes. You will have to look up the fixed version number for each different distribution of Linux you run, and check the installed OpenSSL version against that distribution's specific version numbering to determine if your servers are running a vulnerable version or not.

      linari A bocca storta

      Cylon
      • Avatar
        Scritto da
        Non Autenticato
        il 2014-04-09 06:33:29.0 alle 2014-04-09 06:33:29.0
        Re: Heartbleed Bug - openssl CVE-2014-0160
        Scritto da:
        > Scritto da: ::1
        > > http://www.openssl.org/news/secadv_20140407.txt
        > > http://heartbleed.com/
        >
        > Based on the date displayed by your version of OpenSSL, it seems you are seeing the full version displayed there.
        >
        > Open SSL 1.0.1 was released on March 14th, 2012. 1.0.1a was released on April 19th of 2012.
        >
        > So, I'm going to go ahead and assert that openssl version -a is the proper, cross-distro way to display the full version of OpenSSL that's installed on the system. It seems to work for all the Linux distros I have access to, and is the method suggested in the help.ubuntu.com OpenSSL documentation, as well. Ubuntu LTS 12.04 shipped with vanilla OpenSSL v1.0.1, which is the version that looks like an abbreviated version, on account of not having a letter following it.
        >
        > Having said that, it appears that there is a major bug in Ubuntu (or how they package OpenSSL), in that openssl version -a continues to return the original 1.0.1 version from March 14, 2012, regardless of whether or not OpenSSL has been upgraded to any of the newer versions. And, as with most things when it rains, it pours. Ubuntu is not the only major distro in the dubious habit of backporting updates into OpenSSL (or other packages), rater than relying on the upstream updates and version numbering that everyone recognizes.
        >
        > For example, on Debian, the fixed version displays a version number of 1.0.1e-2+deb7u5, because rather than respecting the upstream versioning scheme, they decided to do their own stupid thing instead.
        >
        > As a result, at this time, there is no reliable, portable way to check SSL versions across Linux distributions, because they all use their own backported patches and updates with different version numbering schemes. You will have to look up the fixed version number for each different distribution of Linux you run, and check the installed OpenSSL version against that distribution's specific version numbering to determine if your servers are running a vulnerable version or not.
        >
        > linari A bocca storta
        >
        > Cylon
        che merda l'opensource.
        se fosse stato closed e a pagamento non sarebbe successo.!Anonimo
<softv>

Pagina generata in 67 millisecondi

Utenti attivi: 9 nell'ultimo minuto, 24 negli ultimi cinque minuti, 54 negli ultimi 15 minuti