OpenSSL CVE-2014-0160 Fixed

Published: 2014-04-08. Last Updated: 2014-04-08 11:14:02 UTC
by Guy Bruneau (Version: 1)
5 comment(s)

OpenSSL 1.0.1g has been released to fix "A missing bounds check in the handling of the TLS heartbeat extension can be used to reveal up to 64kB of memory to a connected client or server. This issue did not affect versions of OpenSSL prior to 1.0.1."[1] known as the Heartbleed Bug [3].

/*** update by Johannes Ullrich ...: ***/

Ubuntu released a patch for affected versions:

http://people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-0160.html

Ubuntu also updated OpenSSH.

CentOS/RHEL has a patch available. 

https://rhn.redhat.com/errata/RHSA-2014-0376.html

For CentOS, the OpenSSL version did not change. Instead, only the compile time changed. To test if you are running the right version, look at the second line of the "openssl version -a" output:

Fixed version:

$ openssl version -a | head -2
OpenSSL 1.0.1e-fips 11 Feb 2013
built on: Tue Apr  8 02:39:29 UTC 2014
 
Old version:
 
OpenSSL 1.0.1e-fips 11 Feb 2013
built on: Wed Jan  8 18:40:59 UTC 2014
 
You probably want to make sure you at least restart affected daemons that load OpenSSL, or just reboot the system. 
 
If you are concerend that the vulnerability was already used to read memory from your systems, you at least should change your SSL keys.

---

The quickest way to figure out which version of OpenSSL you are using is:

openssl version -a

But not that some software may be compiled statically with openssl.

For a vulnerable system, this will return a version of 1.0.1f (or anything but 'g'). Also there will be no complier flag-DOPENSL_NO_HEARTBEATS.

For example, on a current OS X Mavericks system, you will get:

$ openssl version -a
OpenSSL 1.0.1f 6 Jan 2014
built on: Mon Jan  6 23:30:17 PST 2014
platform: darwin64-x86_64-cc
options:  bn(64,64) rc4(ptr,char) des(idx,cisc,16,int) idea(int) blowfish(idx)
compiler: /usr/bin/clang -fPIC -fno-common -DOPENSSL_PIC -DZLIB -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -arch x86_64 -O3 -DL_ENDIAN -Wall -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM
OPENSSLDIR: "/opt/local/etc/openssl"
 
OS X is not listed in [3] as vulnerable, but it is assumed that the list published in [3] is incomplete. The following output comes from a CentOS system, and I used a custom compiled 1.0.1e RPM that had the -DOPENSSL_NO_HEARTBEATS option turned on.
 
# openssl version -a
OpenSSL 1.0.1e-fips 11 Feb 2013
built on: Mon Apr  7 21:56:27 EDT 2014
platform: linux-x86_64
options:  bn(64,64) md2(int) rc4(16x,int) des(idx,cisc,16,int) idea(int) blowfish(idx)
compiler: gcc -fPIC -DOPENSSL_PIC -DZLIB -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -DKRB5_MIT -DOPENSSL_NO_HEARTBEATS -m64 -DL_ENDIAN -DTERMIO -Wall -O2 -g -Wa,--noexecstack -DPURIFY -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM
OPENSSLDIR: "/etc/pki/tls"
engines:  dynamic
 
 
 

[1] http://www.openssl.org/news/secadv_20140407.txt
[2] http://www.openssl.org/news/vulnerabilities.html#2014-0160
[3] http://heartbleed.com

-----------

Guy Bruneau IPSS Inc. gbruneau at isc dot sans dot edu

Keywords: CVE 2014 0160 Heartbleed Bug OpenSSL
5 comment(s)

Comments

Red Hat Enterprise Linux now has a patch available. I'm sure CentOS will be right behind. The prevailing recommendation right now seems to be to revoke and replace the certificates on affected systems. I have no doubt the NSA and others already knew about this.

Anonymous

Apr 8th 2014
1 decade ago

I made a tool to check the status of your SSL and see if heartbeat is enabled. If it is, you should run this command: <b>openssl version -a</b>

Ensure your version is <b>NOT 1.0.1f, 1.0.1e, 1.0.1d, 1.0.1c, 1.0.1b, 1.0.1a, 1.0.1, 1.0.2-beta1</b>

Tool at: http://rehmann.co/projects/heartbeat/

Anonymous

Apr 8th 2014
1 decade ago

I made a tool to check the status of your SSL and see if heartbeat is enabled. If it is, you should run this command: <b>openssl version -a</b>

Ensure your version is <b>NOT 1.0.1f, 1.0.1e, 1.0.1d, 1.0.1c, 1.0.1b, 1.0.1a, 1.0.1, 1.0.2-beta1</b>

Tool at: http://rehmann.co/projects/heartbeat/

Anonymous

Apr 8th 2014
1 decade ago

For Ubuntu if you have updated correctly you should see...

$openssl version -a | head -2

OpenSSL 1.0.1 14 Mar 2012
built on: Mon Apr 7 20:33:29 UTC 2014

Anonymous

Apr 8th 2014
1 decade ago

If someone wouldn't mind verifying...

OSX Mavericks
openssl version -a
OpenSSL 0.9.8y 5 Feb 2013
built on: Aug 24 2013
platform: darwin64-x86_64-llvm
options: bn(64,64) md2(int) rc4(ptr,char) des(idx,cisc,16,int) blowfish(ptr2)
compiler: -arch x86_64 -fmessage-length=0 -pipe -Wno-trigraphs -fpascal-strings -fasm-blocks -O3 -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -DL_ENDIAN -DMD32_REG_T=int -DOPENSSL_NO_IDEA -DOPENSSL_PIC -DOPENSSL_THREADS -DZLIB -mmacosx-version-min=10.6
OPENSSLDIR: "/System/Library/OpenSSL"

I was also showing a vulnerable version when using macports but after uninstalling it the version that ships with OSX Mavericks (/System/Library/OpenSSL) looks ok.

Anonymous

Apr 9th 2014
1 decade ago

Login here to join the discussion.


Top of page
Diary Archives