4 ms·

I have a few ubuntu servers. When I do a "check for heartbleed" check with various tools, it says they are not vulnerable. However, these servers were installed

by neals 13y ago

I have a few ubuntu servers. When I do a "check for heartbleed" check with various tools, it says they are not vulnerable. However, these servers were installed 6 months ago and not updated for at least 2 months. How can they not be vulnerable?

slashdotaccount 13y ago
Maybe they use the GNU TLS library.
fit2rule 13y ago
You might want to rely on some other tool to determine if you are vulnerable or not. Or, just fix it yourself: http://www.ansoncheunghk.info/article/3-simple-steps-update-ubuntu-fix-heartbleed-ssl-bug http://www.ansoncheunghk.info/article/3-simple-steps-update-...
- neals 13y ago
  I ran some of the exploits that were floating around against my own servers and against known vulnerable servers. I got nothing from mine, but lots of scary stuff from the others.
VeejayRampay 13y ago
I am not an expert on the topic by any means, but one possibility is that older versions of impacted software are simply not vulnerable.
- tsenkov 13y ago
  Yep, older versions of OpenSSL are not vulnerable.
- neals 13y ago
  Ok, so I am rewarded for not having an up-to-date system. How about that...
deleted 13y ago
[deleted]
- warp 13y ago
  As I understand 13.04 is just as vulnerable, but not mentioned in that security notice because it is unsupported (end of life).
- balou 13y ago
  13.04 is vulnerable, just out of the support period of ubuntu (decreased from 18 months down to 6 months in 2013) - basically out of luck, either use a ppa, or upgrade to 13.10 http://fridge.ubuntu.com/2013/03/19/changes-in-ubuntu-releases-decided-by-the-ubuntu-technical-board/ http://fridge.ubuntu.com/2013/03/19/changes-in-ubuntu-releas...
gokhan 13y ago
Are you http only?
- neals 13y ago
  no I've got SSL certificates and https set up
rmc 13y ago
Older versions of OpenSSL were not vulnerable. Noticable 10.04 is not vulnerable.
dspillett 13y ago
> How can they not be vulnerable? It very much depends which variant you have installed. 10.04 is not vulnerable at all as it runs with 0.98.something (with some backported fixes, not including the exploit). 12.04 was vulnerable (it carries OpenSSL v1.0.1). There is a very similar situation with Debian's OldStable and Stable, and no doubt with the stable/long-term-support releases from RedHat and everyone else. It also depends what they are testing: some things might be complied against GNUTLS instead of OpenSSL. That has had a vulnerability in recent months too, but is completely unaffected by this one. If you are not using HTTPS (or other TLS wrapped protocols) at all on those servers then you are never going to be susceptible to this particular attack at all. OpenSSH apprently does not use OpenSSL in a manner that exposes he problem, so if all you expose is HTTP and SSH then you are fine (though if your users are sending anything sensitive over plain HTTP they are at risk from other problems).
nikcub 13y ago
Most reports about Heartbleed kept repeating that the vulnerability was introduced 2 years ago (Dec '12, which isn't even 2 years - but anyway) it was committed to a version of OpenSSL (v1.0.1) that wasn't widely distributed until the middle of last year. The time surface of the Heartbleed attack is a lot smaller than what most think. Debian and the BSD projects moved to v1.0.1 earliest, around March/April last year. Ubuntu only upgraded two months ago (in 12.04.4) on the 6th of Feb: http://fridge.ubuntu.com/2014/02/06/ubuntu-12-04-4-lts-released/ http://fridge.ubuntu.com/2014/02/06/ubuntu-12-04-4-lts-relea... Redhat with 6.5 in November 2013: https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/6.5_Release_Notes/bh-chap-security.html https://access.redhat.com/site/documentation/en-US/Red_Hat_E... CentOS Feb 26th 2014: http://wiki.centos.org/Manuals/ReleaseNotes/CentOS6.5 http://wiki.centos.org/Manuals/ReleaseNotes/CentOS6.5
- awda 13y ago
  Fedora has been on OpenSSL 1.0.1 since maybe March 14, 2012 (that was when the .spec was bumped, anyway)[0]. So quite a long window for Fedora users, unfortunately. [0]: http://pkgs.fedoraproject.org/cgit/openssl.git/commit/?h=f18&id=0f0ab241767afcda7d3a21a5b8e7bc770516f2ea http://pkgs.fedoraproject.org/cgit/openssl.git/commit/?h=f18...
  - awda 13y ago
    Whoah, downvote for this? I thought this was factual and helpful... if you disagree, can you at least let me know what's wrong? Thanks. For more details: Fedora 18 shipped with OpenSSL 1.0.1c on 11-Sep-2012: http://mirrors.kernel.org/fedora/releases/18/Everything/x86_64/os/Packages/o/ http://mirrors.kernel.org/fedora/releases/18/Everything/x86_.... So that's 18 months of exposure for Fedora users (including me).
- acqq 13y ago
  It's apparently Dec 2011 not Dec 2012, if we look at the date of the now famous commit: http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=4817504d069b4c5082161b02a22116ad75f822b1 http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=4817... "Sat, 31 Dec 2011 22:59:57 +0000 Support for TLS/DTLS heartbeats. 20 files changed"
lstamour 13y ago
Some builds of nginx linked to earlier libssl releases. This sort of software-level rather than system-level version difference can explain why upgrading "openssl" packages may be insufficient to prevent attacks. Upgrade "libssl" also. To see which version of libssl your stack uses, see ldd and strings: http://nginx.com/blog/nginx-and-the-heartbleed-vulnerability/ http://nginx.com/blog/nginx-and-the-heartbleed-vulnerability...

by neals 13y ago

slashdotaccount 13y ago

Maybe they use the GNU TLS library.

fit2rule 13y ago

You might want to rely on some other tool to determine if you are vulnerable or not. Or, just fix it yourself: http://www.ansoncheunghk.info/article/3-simple-steps-update-ubuntu-fix-heartbleed-ssl-bug http://www.ansoncheunghk.info/article/3-simple-steps-update-...

neals 13y ago
I ran some of the exploits that were floating around against my own servers and against known vulnerable servers. I got nothing from mine, but lots of scary stuff from the others.

VeejayRampay 13y ago

I am not an expert on the topic by any means, but one possibility is that older versions of impacted software are simply not vulnerable.

tsenkov 13y ago
Yep, older versions of OpenSSL are not vulnerable.
neals 13y ago
Ok, so I am rewarded for not having an up-to-date system. How about that...

deleted 13y ago

[deleted]

warp 13y ago
As I understand 13.04 is just as vulnerable, but not mentioned in that security notice because it is unsupported (end of life).
balou 13y ago
13.04 is vulnerable, just out of the support period of ubuntu (decreased from 18 months down to 6 months in 2013) - basically out of luck, either use a ppa, or upgrade to 13.10 http://fridge.ubuntu.com/2013/03/19/changes-in-ubuntu-releases-decided-by-the-ubuntu-technical-board/ http://fridge.ubuntu.com/2013/03/19/changes-in-ubuntu-releas...

gokhan 13y ago

Are you http only?

neals 13y ago
no I've got SSL certificates and https set up

rmc 13y ago

Older versions of OpenSSL were not vulnerable. Noticable 10.04 is not vulnerable.

dspillett 13y ago

> How can they not be vulnerable? It very much depends which variant you have installed. 10.04 is not vulnerable at all as it runs with 0.98.something (with some backported fixes, not including the exploit). 12.04 was vulnerable (it carries OpenSSL v1.0.1). There is a very similar situation with Debian's OldStable and Stable, and no doubt with the stable/long-term-support releases from RedHat and everyone else. It also depends what they are testing: some things might be complied against GNUTLS instead of OpenSSL. That has had a vulnerability in recent months too, but is completely unaffected by this one. If you are not using HTTPS (or other TLS wrapped protocols) at all on those servers then you are never going to be susceptible to this particular attack at all. OpenSSH apprently does not use OpenSSL in a manner that exposes he problem, so if all you expose is HTTP and SSH then you are fine (though if your users are sending anything sensitive over plain HTTP they are at risk from other problems).

nikcub 13y ago

Most reports about Heartbleed kept repeating that the vulnerability was introduced 2 years ago (Dec '12, which isn't even 2 years - but anyway) it was committed to a version of OpenSSL (v1.0.1) that wasn't widely distributed until the middle of last year. The time surface of the Heartbleed attack is a lot smaller than what most think. Debian and the BSD projects moved to v1.0.1 earliest, around March/April last year. Ubuntu only upgraded two months ago (in 12.04.4) on the 6th of Feb: http://fridge.ubuntu.com/2014/02/06/ubuntu-12-04-4-lts-released/ http://fridge.ubuntu.com/2014/02/06/ubuntu-12-04-4-lts-relea... Redhat with 6.5 in November 2013: https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/6.5_Release_Notes/bh-chap-security.html https://access.redhat.com/site/documentation/en-US/Red_Hat_E... CentOS Feb 26th 2014: http://wiki.centos.org/Manuals/ReleaseNotes/CentOS6.5 http://wiki.centos.org/Manuals/ReleaseNotes/CentOS6.5

awda 13y ago
Fedora has been on OpenSSL 1.0.1 since maybe March 14, 2012 (that was when the .spec was bumped, anyway)[0]. So quite a long window for Fedora users, unfortunately. [0]: http://pkgs.fedoraproject.org/cgit/openssl.git/commit/?h=f18&id=0f0ab241767afcda7d3a21a5b8e7bc770516f2ea http://pkgs.fedoraproject.org/cgit/openssl.git/commit/?h=f18...
- awda 13y ago
  Whoah, downvote for this? I thought this was factual and helpful... if you disagree, can you at least let me know what's wrong? Thanks. For more details: Fedora 18 shipped with OpenSSL 1.0.1c on 11-Sep-2012: http://mirrors.kernel.org/fedora/releases/18/Everything/x86_64/os/Packages/o/ http://mirrors.kernel.org/fedora/releases/18/Everything/x86_.... So that's 18 months of exposure for Fedora users (including me).
acqq 13y ago
It's apparently Dec 2011 not Dec 2012, if we look at the date of the now famous commit: http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=4817504d069b4c5082161b02a22116ad75f822b1 http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=4817... "Sat, 31 Dec 2011 22:59:57 +0000 Support for TLS/DTLS heartbeats. 20 files changed"

lstamour 13y ago

Some builds of nginx linked to earlier libssl releases. This sort of software-level rather than system-level version difference can explain why upgrading "openssl" packages may be insufficient to prevent attacks. Upgrade "libssl" also. To see which version of libssl your stack uses, see ldd and strings: http://nginx.com/blog/nginx-and-the-heartbleed-vulnerability/ http://nginx.com/blog/nginx-and-the-heartbleed-vulnerability...