* Patch Now: OpenSSL "Heartbleed" Vulnerability
(this article is work in progress and will be updated as we have new information. Also see the comments for links to signatures and other information provided by readers)
We decided to go to Infocon Yellow to alert readers of this vulenrability.
For those of you using OpenSSL 1.0.1 (most recent Unix systems), it is critical that you patch the openssl library, as well as binaries compiled statically with openssl, as soon as possible. [1]
The attack will allow a remote attacker to read up to 64kBytes of system memory from your system per attack attempt. The attack works against servers as well as against clients. While not all software using SSL necessarily uses the OpenSSL library, many do. (see our prior diary)
A proof of concept exploit has been made available and I have tested it. It can be used to remotely scan for vulnerable systems. [1] We have not yet detected wide spread use of the exploit, but it is literally hours old. At this point, we don't think the vulnerability was known in the underground before the official release, but it is possible.
What should you do first:
Check if you are vulnerable. "openssl version -a" will return the version information. If your version is 1.0.1, you MAY be vulnerable. Only version 1.0.1g is NOT vulnerable. Other major versions (0.9x, 1.0.0 ...) are not vulnerable.
Rule of thumb: If you are using OpenSSL, and if you are supporting TLS 1.2 (check ssllabs.com) , then you are vulnerable unless patched.
If I am vulnerable, what should I do:
Patch! Ubuntu, CentOS and others have patches available. OS X Mavericks has NO PATCH available. Windows is likely not vulnerable, but if you are running open source software like Apache that uses OpenSSL, then you may be vulnerable.
You may want to consider replacing SSL certificates if you are afraid that the exploit was already used against your site. But the exploit is not limited to secret SSL key. All data in memory is potentially at risk.
Can I test remotely?
The PoC exploit above can be used to scan your network remotely.
How Can I Tell if Someone is Using the Exploit Against Me
We don't have IDS signatures (yet... wait for updates here). There is no log entry in your web server log as the exploit happens after the SSL session is established, and before the HTTP request is sent.
nginx, after being patched, logs the following from the PoC exploit:
2014/04/08 12:37:18 [info] 4151#0: *724561 peer closed connection in SSL handshake while SSL handshaking, client: 70.91.145.11, server: 0.0.0.0:8443
[1] http://heartbleed.com
[2] http://s3.jspenguin.org/ssltest.py
------
Johannes B. Ullrich, Ph.D.
SANS Technology Institute
Twitter
Network Monitoring and Threat Detection In-Depth | Singapore | Nov 18th - Nov 23rd 2024 |
Comments
If TLS 1.0 is the latest version, you may not be vulnerable because the older v0.9.8 did not support TLS 1.1 and TLS 1.2. Or it could just be disabled but still vulnerable.
If you have so-called "appliances" you're probably running some Linux and OpenSSL variant.
Start opening tickets with your appliance vendors. I'm not seeing many posting updates yet.
If you have a vulnerable Internet-facing site, consider revoking and replacing the SSL certificate. That's usually free during the lifetime of the certificate.
Anonymous
Apr 8th 2014
1 decade ago
http://blog.fox-it.com/2014/04/08/openssl-heartbleed-bug-live-blog/
Anonymous
Apr 8th 2014
1 decade ago
https://github.com/openssl/openssl/commit/4817504d069b4c5082161b02a22116ad75f822b1
Anonymous
Apr 8th 2014
1 decade ago
http://blog.inliniac.net/2014/04/08/detecting-openssl-heartbleed-with-suricata/
Anonymous
Apr 8th 2014
1 decade ago
SSL Labs Test for the Heartbleed Attack
https://community.qualys.com/blogs/securitylabs/2014/04/08/ssl-labs-test-for-the-heartbleed-attack
https://www.ssllabs.com/ssltest/
Thanks to him for his great work!
Anonymous
Apr 8th 2014
1 decade ago
Anonymous
Apr 8th 2014
1 decade ago
Anonymous
Apr 8th 2014
1 decade ago
Thanks,
Mike
Anonymous
Apr 9th 2014
1 decade ago
Anonymous
Apr 9th 2014
1 decade ago
Anonymous
Apr 9th 2014
1 decade ago