OpenSSL CVE-2014-0160 Fixed

Published: 2014-04-08
Last Updated: 2014-04-08 11:14:02 UTC
by Guy Bruneau (Version: 1)
5 comment(s)

OpenSSL 1.0.1g has been released to fix "A missing bounds check in the handling of the TLS heartbeat extension can be used to reveal up to 64kB of memory to a connected client or server. This issue did not affect versions of OpenSSL prior to 1.0.1."[1] known as the Heartbleed Bug [3].

/*** update by Johannes Ullrich ...: ***/

Ubuntu released a patch for affected versions:

Ubuntu also updated OpenSSH.

CentOS/RHEL has a patch available.

For CentOS, the OpenSSL version did not change. Instead, only the compile time changed. To test if you are running the right version, look at the second line of the "openssl version -a" output:

Fixed version:

$ openssl version -a | head -2
OpenSSL 1.0.1e-fips 11 Feb 2013
built on: Tue Apr  8 02:39:29 UTC 2014
Old version:
OpenSSL 1.0.1e-fips 11 Feb 2013
built on: Wed Jan  8 18:40:59 UTC 2014
You probably want to make sure you at least restart affected daemons that load OpenSSL, or just reboot the system. 
If you are concerend that the vulnerability was already used to read memory from your systems, you at least should change your SSL keys.


The quickest way to figure out which version of OpenSSL you are using is:

openssl version -a

But not that some software may be compiled statically with openssl.

For a vulnerable system, this will return a version of 1.0.1f (or anything but 'g'). Also there will be no complier flag-DOPENSL_NO_HEARTBEATS.

For example, on a current OS X Mavericks system, you will get:

$ openssl version -a
OpenSSL 1.0.1f 6 Jan 2014
built on: Mon Jan  6 23:30:17 PST 2014
platform: darwin64-x86_64-cc
options:  bn(64,64) rc4(ptr,char) des(idx,cisc,16,int) idea(int) blowfish(idx)
OPENSSLDIR: "/opt/local/etc/openssl"
OS X is not listed in [3] as vulnerable, but it is assumed that the list published in [3] is incomplete. The following output comes from a CentOS system, and I used a custom compiled 1.0.1e RPM that had the -DOPENSSL_NO_HEARTBEATS option turned on.
# openssl version -a
OpenSSL 1.0.1e-fips 11 Feb 2013
built on: Mon Apr  7 21:56:27 EDT 2014
platform: linux-x86_64
options:  bn(64,64) md2(int) rc4(16x,int) des(idx,cisc,16,int) idea(int) blowfish(idx)
OPENSSLDIR: "/etc/pki/tls"
engines:  dynamic



Guy Bruneau IPSS Inc. gbruneau at isc dot sans dot edu

5 comment(s)
Diary Archives