4 ms·

Given the severity of this bug, the UX of the site is failing anyone who isn't a fulltime sysadmin. Suggestion: big, bold TLDR ("The sky is falling. Check your

by phillmv 13y ago

Given the severity of this bug, the UX of the site is failing anyone who isn't a fulltime sysadmin. Suggestion: big, bold TLDR ("The sky is falling. Check your OpenSSL version right now") with a link on what to do sorted by OS vendor. Step 1: Here's a command to spit out your OpenSSL version. If it is the following string, go to step 2. Step 2: Here's how to update your OpenSSL. Here are links to guides on reissuing keys. Probably OK the whole remediation bit links to a wiki that gets updated as the various vendors push their patches.

earless1 13y ago
On my CentOS boxes I ran 'yum list | grep openssl'
- dmix 13y ago
  This is the standard command: $ openssl version > OpenSSL 1.0.1f 6 Jan 2014
  - stormbrew 13y ago
    As far as I can tell, on ubuntu this reports "OpenSSL 1.0.1 14 Mar 2012" for all ubuntu versions, including the fixed one.
    - chokma 13y ago
      With "openssl version -a" you can see the built time. root@x ~ # openssl version -a OpenSSL 1.0.1 14 Mar 2012 built on: Mon Apr 7 20:33:29 UTC 2014
    - imsofuture 13y ago
      try: dpkg -s openssl
    - mayneack 13y ago
      My Linux Mint machine (based on 13.10) went from 1.0.1e Feb 2014 to 1.01 Mar 2012 int the last 2 hours, so that's definitely new.
      - Turing_Machine 13y ago
        I think someone screwed up on the version string big time.
    - Turing_Machine 13y ago
      Same here. I got a "security warning" update when I logged in to the server (good), ran apt-get and installed, did openssl version, got the string as noted above (which seemed just a tad out of date). So... I built and installed from source, and got... the same string. Annoying.
  - house9-2 13y ago
    @stormbrew is correct about ubuntu, use -a or -v -b openssl version -v -b OpenSSL 1.0.1 14 Mar 2012 built on: Wed Jan 8 20:45:51 UTC 2014
    - spatten 13y ago
      I'm totally confused by this. I'm running ubuntu LTS 12.04 and did sudo aptitude update sudo aptitude upgrade openssl and then ran openssl version -a and got the same results as you. How can it be built on January 8th if the patch was just made today? [EDIT] running sudo aptitude upgrade upgraded properly and now I'm getting a version that was compiled earlier today. I'm guessing I needed to update another package as well. Probably `libssl`?
      - benmmurphy 13y ago
        upgrade will work because it updates libssl1.0.0 which is the package you want upgraded :) Openssl is the command line package and libssl1.0.0 is the library. i was able to upgrade openssl without upgrading libssl1.0.0. ben@ip-10-0-0-76:~$ dpkg -s libssl1.0.0 |grep Version Version: 1.0.1e-3ubuntu1 ben@ip-10-0-0-76:~$ dpkg -s openssl |grep Version Version: 1.0.1e-3ubuntu1 ben@ip-10-0-0-76:~$ sudo apt-get install openssl ... ben@ip-10-0-0-76:~$ dpkg -s libssl1.0.0 |grep Version Version: 1.0.1e-3ubuntu1 ben@ip-10-0-0-76:~$ dpkg -s openssl |grep Version Version: 1.0.1e-3ubuntu1.2 ben@ip-10-0-0-76:~$ openssl version -a OpenSSL 1.0.1e 11 Feb 2013 built on: Mon Jul 15 12:44:45 UTC 2013 platform: debian-amd64 options: bn(64,64) rc4(16x,int) des(idx,cisc,16,int) blowfish(idx) compiler: cc -fPIC -DOPENSSL_PIC -DZLIB -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -m64 -DL_ENDIAN -DTERMIO -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Werror=format-security -D_FORTIFY_SOURCE=2 -Wl,-Bsymbolic-functions -Wl,-z,relro -Wa,--noexecstack -Wall -DOPENSSL_NO_TLS1_2_CLIENT -DOPENSSL_MAX_TLS1_2_CIPHER_LENGTH=50 -DMD32_REG_T=int -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM OPENSSLDIR: "/usr/lib/ssl" ben@ip-10-0-0-76:~$ sudo apt-get install libssl1.0.0 ben@ip-10-0-0-76:~$ dpkg -s libssl1.0.0 |grep Version Version: 1.0.1e-3ubuntu1.2 ben@ip-10-0-0-76:~$ openssl version -a OpenSSL 1.0.1e 11 Feb 2013 built on: Mon Apr 7 20:33:19 UTC 2014 platform: debian-amd64 options: bn(64,64) rc4(16x,int) des(idx,cisc,16,int) blowfish(idx) compiler: cc -fPIC -DOPENSSL_PIC -DZLIB -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -m64 -DL_ENDIAN -DTERMIO -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Werror=format-security -D_FORTIFY_SOURCE=2 -Wl,-Bsymbolic-functions -Wl,-z,relro -Wa,--noexecstack -Wall -DOPENSSL_NO_TLS1_2_CLIENT -DOPENSSL_MAX_TLS1_2_CIPHER_LENGTH=50 -DMD32_REG_T=int -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM OPENSSLDIR: "/usr/lib/ssl" i wonder how many people will do apt-get update openssl and assume they have fixed it
personjerry 13y ago
Agreed. They should reorder their headings, first should be What is it? and second should be How to stop it?
lawl 13y ago
Agree. This needs a big fat the world is coming to an end stlye of warning. I've just shut down the webservers running SSL that I can control. If you are vuln and don't want to build openssl from source and can afford the outage. I'd reccomend to do the same. OTHERWISE BUILD FROM SOURCE IMMEDIATELY, PATCH, AND GET NEW KEYS! Let's hope CA's don't get swamped by all the CSR's. Or rather let's hope they do so we see people are doing something... For me right now these are just my hobby projects. So I don't care if they're down. But I imagine it will be fun tomorrow. And when it's fixed, get new keys. Btw: I'm a dev. Not a sysadmin though :P Edit: Debian is patched. I'm online again \o/
- M4v3R 13y ago
  Ok, anyone could assist me on how to update openssl without breaking anything? I've fetched newest sources from openssl.org and compiled them, but "make install" doesn't actually install it, it only got compiled, but issuing "openssl version" still gives me the old version. What I want to do is to patch it so our webserver uses new version.
  - josh-wrale 13y ago
    I would tread lightly here if you aren't comfortable with compiling. Rather than break your website, it might be better to take it down until your distro's packages are available. You should probably spend your time investigating a good method of reissuing keys for when you get to a stable OpenSSL version. Some apps have OpenSSL statically compiled into the binaries. Beware that what you think is fixed may not be.
    - M4v3R 13y ago
      Well, I'm not really in position of taking the whole service down at this moment, I would really like to have a way to patch it instead.
      - josh-wrale 13y ago
        Depending on the distro on which you're based, you may find that making a new package from a source package (e.g. srpm) would be the safest route even if you're in a hurry. If you're on Ubuntu, it would appear at least the updated base (OpenSSL itself) packages are now in the repos. http://people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-0160.html http://people.canonical.com/~ubuntu-security/cve/2014/CVE-20...
dfa0 13y ago
On a linux box: [For each set of certs used for each of your public facing sites...] 1. Open a terminal[cd into] /etc/path_to_ssl_certs_folder[per site]. Ex. /etc/ssl/nginx 2. Regen the certs [example nginx mail server] openssl req -x509 -sha256 -nodes -days 3650 -newkey rsa:4096 -keyout mailkey.pem -out mailcert.pem [this command generates a private key and server cert and outputs to pem's] [Note also the key sizes are 4096, you may want 2048. AND I use -sha256, as sha1 is considered too weak nowadays. These certs are valid for 3650 days...10 years] Since the command overwrites certs/keys in the current directory of the same name as the outfiles...that's it...you're done. Just restart nginx. If you change a self-signed cert, like above, expect a new warning from the client on the next connection...this is just your new cert being encountered. Click permantly accept..blah blah. ------------------------------------------------------------------------ On a Windows box: 1. open an admin cmd window and run 'mmc'. 2. Add a new snap-in for Certificates as local machine. 3. Find and 'Disable all purposes for this cert'. 4. Import your new certs from your 3rd party or that you rolled yourself from your enterprise CA. 5. Test new cert. 6. Delete old cert. [If you run your own CA, you should already know what to do...]

by phillmv 13y ago

earless1 13y ago

On my CentOS boxes I ran 'yum list | grep openssl'

dmix 13y ago
This is the standard command: $ openssl version > OpenSSL 1.0.1f 6 Jan 2014
- stormbrew 13y ago
  As far as I can tell, on ubuntu this reports "OpenSSL 1.0.1 14 Mar 2012" for all ubuntu versions, including the fixed one.
  - chokma 13y ago
    With "openssl version -a" you can see the built time. root@x ~ # openssl version -a OpenSSL 1.0.1 14 Mar 2012 built on: Mon Apr 7 20:33:29 UTC 2014
  - imsofuture 13y ago
    try: dpkg -s openssl
  - mayneack 13y ago
    My Linux Mint machine (based on 13.10) went from 1.0.1e Feb 2014 to 1.01 Mar 2012 int the last 2 hours, so that's definitely new.
    - Turing_Machine 13y ago
      I think someone screwed up on the version string big time.
  - Turing_Machine 13y ago
    Same here. I got a "security warning" update when I logged in to the server (good), ran apt-get and installed, did openssl version, got the string as noted above (which seemed just a tad out of date). So... I built and installed from source, and got... the same string. Annoying.
- house9-2 13y ago
  @stormbrew is correct about ubuntu, use -a or -v -b openssl version -v -b OpenSSL 1.0.1 14 Mar 2012 built on: Wed Jan 8 20:45:51 UTC 2014
  - spatten 13y ago
    I'm totally confused by this. I'm running ubuntu LTS 12.04 and did sudo aptitude update sudo aptitude upgrade openssl and then ran openssl version -a and got the same results as you. How can it be built on January 8th if the patch was just made today? [EDIT] running sudo aptitude upgrade upgraded properly and now I'm getting a version that was compiled earlier today. I'm guessing I needed to update another package as well. Probably `libssl`?
    - benmmurphy 13y ago
      upgrade will work because it updates libssl1.0.0 which is the package you want upgraded :) Openssl is the command line package and libssl1.0.0 is the library. i was able to upgrade openssl without upgrading libssl1.0.0. ben@ip-10-0-0-76:~$ dpkg -s libssl1.0.0 |grep Version Version: 1.0.1e-3ubuntu1 ben@ip-10-0-0-76:~$ dpkg -s openssl |grep Version Version: 1.0.1e-3ubuntu1 ben@ip-10-0-0-76:~$ sudo apt-get install openssl ... ben@ip-10-0-0-76:~$ dpkg -s libssl1.0.0 |grep Version Version: 1.0.1e-3ubuntu1 ben@ip-10-0-0-76:~$ dpkg -s openssl |grep Version Version: 1.0.1e-3ubuntu1.2 ben@ip-10-0-0-76:~$ openssl version -a OpenSSL 1.0.1e 11 Feb 2013 built on: Mon Jul 15 12:44:45 UTC 2013 platform: debian-amd64 options: bn(64,64) rc4(16x,int) des(idx,cisc,16,int) blowfish(idx) compiler: cc -fPIC -DOPENSSL_PIC -DZLIB -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -m64 -DL_ENDIAN -DTERMIO -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Werror=format-security -D_FORTIFY_SOURCE=2 -Wl,-Bsymbolic-functions -Wl,-z,relro -Wa,--noexecstack -Wall -DOPENSSL_NO_TLS1_2_CLIENT -DOPENSSL_MAX_TLS1_2_CIPHER_LENGTH=50 -DMD32_REG_T=int -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM OPENSSLDIR: "/usr/lib/ssl" ben@ip-10-0-0-76:~$ sudo apt-get install libssl1.0.0 ben@ip-10-0-0-76:~$ dpkg -s libssl1.0.0 |grep Version Version: 1.0.1e-3ubuntu1.2 ben@ip-10-0-0-76:~$ openssl version -a OpenSSL 1.0.1e 11 Feb 2013 built on: Mon Apr 7 20:33:19 UTC 2014 platform: debian-amd64 options: bn(64,64) rc4(16x,int) des(idx,cisc,16,int) blowfish(idx) compiler: cc -fPIC -DOPENSSL_PIC -DZLIB -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -m64 -DL_ENDIAN -DTERMIO -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Werror=format-security -D_FORTIFY_SOURCE=2 -Wl,-Bsymbolic-functions -Wl,-z,relro -Wa,--noexecstack -Wall -DOPENSSL_NO_TLS1_2_CLIENT -DOPENSSL_MAX_TLS1_2_CIPHER_LENGTH=50 -DMD32_REG_T=int -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM OPENSSLDIR: "/usr/lib/ssl" i wonder how many people will do apt-get update openssl and assume they have fixed it

personjerry 13y ago

Agreed. They should reorder their headings, first should be What is it? and second should be How to stop it?

lawl 13y ago

Agree. This needs a big fat the world is coming to an end stlye of warning. I've just shut down the webservers running SSL that I can control. If you are vuln and don't want to build openssl from source and can afford the outage. I'd reccomend to do the same. OTHERWISE BUILD FROM SOURCE IMMEDIATELY, PATCH, AND GET NEW KEYS! Let's hope CA's don't get swamped by all the CSR's. Or rather let's hope they do so we see people are doing something... For me right now these are just my hobby projects. So I don't care if they're down. But I imagine it will be fun tomorrow. And when it's fixed, get new keys. Btw: I'm a dev. Not a sysadmin though :P Edit: Debian is patched. I'm online again \o/

M4v3R 13y ago
Ok, anyone could assist me on how to update openssl without breaking anything? I've fetched newest sources from openssl.org and compiled them, but "make install" doesn't actually install it, it only got compiled, but issuing "openssl version" still gives me the old version. What I want to do is to patch it so our webserver uses new version.
- josh-wrale 13y ago
  I would tread lightly here if you aren't comfortable with compiling. Rather than break your website, it might be better to take it down until your distro's packages are available. You should probably spend your time investigating a good method of reissuing keys for when you get to a stable OpenSSL version. Some apps have OpenSSL statically compiled into the binaries. Beware that what you think is fixed may not be.
  - M4v3R 13y ago
    Well, I'm not really in position of taking the whole service down at this moment, I would really like to have a way to patch it instead.
    - josh-wrale 13y ago
      Depending on the distro on which you're based, you may find that making a new package from a source package (e.g. srpm) would be the safest route even if you're in a hurry. If you're on Ubuntu, it would appear at least the updated base (OpenSSL itself) packages are now in the repos. http://people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-0160.html http://people.canonical.com/~ubuntu-security/cve/2014/CVE-20...

dfa0 13y ago

On a linux box: [For each set of certs used for each of your public facing sites...] 1. Open a terminal[cd into] /etc/path_to_ssl_certs_folder[per site]. Ex. /etc/ssl/nginx 2. Regen the certs [example nginx mail server] openssl req -x509 -sha256 -nodes -days 3650 -newkey rsa:4096 -keyout mailkey.pem -out mailcert.pem [this command generates a private key and server cert and outputs to pem's] [Note also the key sizes are 4096, you may want 2048. AND I use -sha256, as sha1 is considered too weak nowadays. These certs are valid for 3650 days...10 years] Since the command overwrites certs/keys in the current directory of the same name as the outfiles...that's it...you're done. Just restart nginx. If you change a self-signed cert, like above, expect a new warning from the client on the next connection...this is just your new cert being encountered. Click permantly accept..blah blah. ------------------------------------------------------------------------ On a Windows box: 1. open an admin cmd window and run 'mmc'. 2. Add a new snap-in for Certificates as local machine. 3. Find and 'Disable all purposes for this cert'. 4. Import your new certs from your 3rd party or that you rolled yourself from your enterprise CA. 5. Test new cert. 6. Delete old cert. [If you run your own CA, you should already know what to do...]