Heartbleed: Distros with patched/updated openssl libs available?

Rainmaker

Rainmaker

Rainmaker

Soldato
Joined
18 Aug 2007
Posts
9,793
Location
Liverpool
As topic. Google is proving fruitless and the main distros aren't saying much on their respective websites atm. I know older distros (eg *buntu 10.04 LTS, which is still supported) and the old Debian stable are unaffected already.

However does anyone know which of the more current distros (affected by the CVE) have already made available updates to patch openssl for Heartbleed?
 
https://www.openssl.org/news/secadv_20140407.txt

Most of the modern and popular distros using exploitable versions will have issued patches. It's a case of simply updating systems as one would normally. Most distros will have issued notices via their security and advisories mailing lists, if you check system history logs over the past couple of days, the update should be in there from the 7th (when this bug seems to have appeared) onwards.

Edit: Also; http://heartbleed.com/

How about operating systems?

Some operating system distributions that have shipped with potentially vulnerable OpenSSL version:

Debian Wheezy (stable), OpenSSL 1.0.1e-2+deb7u4
Ubuntu 12.04.4 LTS, OpenSSL 1.0.1-4ubuntu5.11
CentOS 6.5, OpenSSL 1.0.1e-15
Fedora 18, OpenSSL 1.0.1e-4
OpenBSD 5.3 (OpenSSL 1.0.1c 10 May 2012) and 5.4 (OpenSSL 1.0.1c 10 May 2012)
FreeBSD 10.0 - OpenSSL 1.0.1e 11 Feb 2013
NetBSD 5.0.2 (OpenSSL 1.0.1e)
OpenSUSE 12.2 (OpenSSL 1.0.1c)

Operating system distribution with versions that are not vulnerable:

Debian Squeeze (oldstable), OpenSSL 0.9.8o-4squeeze14
SUSE Linux Enterprise Server
FreeBSD 8.4 - OpenSSL 0.9.8y 5 Feb 2013
FreeBSD 9.2 - OpenSSL 0.9.8y 5 Feb 2013
FreeBSD Ports - OpenSSL 1.0.1g (At 7 Apr 21:46:40 2014 UTC)

How can OpenSSL be fixed?

Even though the actual code fix may appear trivial, OpenSSL team is the expert in fixing it properly so latest fixed version 1.0.1g or newer should be used. If this is not possible software developers can recompile OpenSSL with the handshake removed from the code by compile time option -DOPENSSL_NO_HEARTBEATS.

Should heartbeat be removed to aid in detection of vulnerable services?

Recovery from this bug could benefit if the new version of the OpenSSL would both fix the bug and disable heartbeat temporarily until some future version. It appears that majority if not almost all TLS implementations that respond to the heartbeat request today are vulnerable versions of OpenSSL. If only vulnerable versions of OpenSSL would continue to respond to the heartbeat for next few months then large scale coordinated response to reach owners of vulnerable services would become more feasible.
Click to expand...
 
Last edited:
I would add to the above that RHEL 6.5, as it is upstream from CentOS 6.5, is affected too but note that RHEL already has a fixed OpenSSL package released so I would expect that to be available for CentOS soon if it isn't already. Note that whilst OpenSSL are fixing this in 1.0.1g RedHat maintain version numbers within releases, with the fixes back ported, so a fixed RHEL 6.5 / CentOS 6.5 box will still be running 1.0.1e just at a different minor version.

edit: Patched version for RHEL 6.5 / CentOS 6.5 would appear to be: openssl-1.0.1e-16.el6_5.7

RHEL 5.10 / CentOS 5.10 should not be affected as it doesn't ship with the affected OpenSSL version.
 
Last edited:
memyselfandi said:
I would add to the above that RHEL 6.5, as it is upstream from CentOS 6.5, is affected too but note that RHEL already has a fixed OpenSSL package released so I would expect that to be available for CentOS soon if it isn't already. Note that whilst OpenSSL are fixing this in 1.0.1g RedHat maintain version numbers within releases, with the fixes back ported, so a fixed RHEL 6.5 / CentOS 6.5 box will still be running 1.0.1e just at a different minor version.

edit: Patched version for RHEL 6.5 / CentOS 6.5 would appear to be: openssl-1.0.1e-16.el6_5.7

RHEL 5.10 / CentOS 5.10 should not be affected as it doesn't ship with the affected OpenSSL version.
Click to expand...

CentOS had a patch yesterday morning when I checked. Patching won't reissue your SSL certs.
 
You must log in or register to reply here.
Back
Top Bottom