Soldato
- Joined
- 8 Mar 2007
- Posts
- 10,938
Affected
Heartbleed Bug
- Thread starter thedoc46
- Start date
Affected
Meh.. It's only one version of open SSL that's affected! And trust me rarely do the sites run latest releases 
for e.g. we don't even have to update because the OS on a server is 5 years old lol.. And that version of open SSL is fine.
for e.g. we don't even have to update because the OS on a server is 5 years old lol.. And that version of open SSL is fine.
Meh.. It's only one version of open SSL that's affected! And trust me rarely do the sites run latest releases
The version that shipped with the RHEL6 branch was effected, its not a small number by any stretch of the imagination.
My RHEL6 servers fortunately are all patched and RHEL 5 is unaffected
Soldato
- Joined
- 10 Oct 2005
- Posts
- 8,718
- Location
- Nottingham
The version that shipped with the RHEL6 branch was effected, its not a small number by any stretch of the imagination.
My RHEL6 servers fortunately are all patched and RHEL 5 is unaffected
Actually for RHEL it was the version which shipped with RHEL 6.5 in Q4 last year and the subsequent patch versions up to the version released for this this week. So if you are on 6.4 say you are not on a version with the issue. (from Red Hat's advisory).
There's little point to resetting passwords if the service hasn't addressed the issue yet, as your new password could just be grabbed from memory in the same way ... In fact potentially it is more likely to be as now it's been so widely publicised there will be more script kiddies trying to exploit it.
Yea but given the .0-.5 are only second point releases, most admins will have upgraded as they came out.
Quite funny really - I regularly get emails of the OMFGWTF!!! I have virus!!! Get to the Choppa!!! We are all going to DIE!!! variety from a few of my friends who have no idea that the false facebook scam they have forwarded is probably making them more vulnerable not helping anyone.
A full on SSL vulnerability and how much have I heard? Nada
Just a few people that know what they are doing calmly fixing the problem.
A full on SSL vulnerability and how much have I heard? Nada
Just a few people that know what they are doing calmly fixing the problem.
Soldato
- Joined
- 10 Oct 2005
- Posts
- 8,718
- Location
- Nottingham
Not really no, Red Hat have screwed up to many times with the 6.x releases (e.g. breaking vlaning and bonding at times with kernel updates) so a lot of places I know are not rolling out wide patching and just using targeted security patching and delaying patching of anyting not absolutely critical.
In theory yes the minor point releases are just milestones in the 6.x patch continuum for existing servers so you should just be able to patch up through them but tell that to paranoid customers who have been burnt before.
I must have been really lucky then?
On the 6.x branch I have had 0 issues at all the entire way.5.x I will admit some problems with the earlier versions, but the later ones were fine.
This is a good point and illustrates why 2 factor auth is worth doing. It's possible to setup 2FA on many common sites (Dropbox, Facebook, GoogleMail, PayPal, etc.) and I would highly advise people do it.
I tried buying Watch Dogs last week on Origin but couldn't complete the checkout, my card couldn't be verified. Tried buying some stuff off SportsDirect an hour ago and again my card couldn't be verified. So I phoned the bank up and was told my card is blocked on Verified by Visa, and on the 7th of March a payment was attempted to Western Union, not by me, so I have a new card in the post.
Makes me wonder if Heartbleed is the culprit.
Makes me wonder if Heartbleed is the culprit.
Soldato
- Joined
- 12 Dec 2002
- Posts
- 2,951
If the whole internet has been compromised the odds of your details being picked are probrobably equal to winning the lottery, I would assume having your card cloned in a petrol garage etc... Would be much more likely.
I could be very wrong but if you are going to snoop online I would be looking at the places where very high value goods are sold, for obvious reasons.
Highly unlikely to be heartbleed if it happened on the 7th of March.