Last edited:
OpenSSL Bug: Heartbleed
- Thread starter escoreal
- Start date
I upgrade my OpenSSL:
and restart PVE Demon:
Test with: https://github.com/titanous/heartbleeder
What i need to do?
Code:
# cd /usr/src
# wget http://www.openssl.org/source/openssl-1.0.1g.tar.gz
# tar -xvzf openssl-1.0.1g.tar.gz
# cd openssl-1.0.1g
# ./config --prefix=/usr no-threads shared
# make
# make test
# make install
# openssl version
OpenSSL 1.0.1g 7 Apr 2014and restart PVE Demon:
Code:
# /etc/init.d/pvedaemon restartTest with: https://github.com/titanous/heartbleeder
Code:
# ./heartbleeder ********:8006
INSECURE - ********:8006 has the heartbeat extension enabled and is vulnerableWhat i need to do?
Hello,
minimal upgrade:
or with Apache Reverse Proxy:
esco
minimal upgrade:
Code:
aptitude upgrade libssl1.0.0
/etc/init.d/pveproxy restartor with Apache Reverse Proxy:
Code:
aptitude upgrade apache2 apache2-mpm-prefork apache2-utils apache2.2-bin apache2.2-common
/etc/init.d/apache2 restartesco
I found out that port 8006 of my server was still vulnerable today, although openssl was (automatically) updated few hours after 0.
Isn't it possible to configure the debian package such that it automatically restarts, as was the case e.g. for the Apache service? Otherwise security updates may have no effect, as in this case.
I'm on Debian 7.4 wheezy with Proxmox. "openssl version" responds with "OpenSSL 1.0.1e 11 Feb 2013". apt-get update && apt-get upgrade does not install the patched version. My sources.list contains the line "deb http://security.debian.org/ wheezy/updates main contrib".
The same is with various turnkey debian wheezy servers (CT and/or VM). Plain Debian wheezy guests are ok. Anyone any idea?
(All servers are on local nets.)
The same here:
openssl version
OpenSSL 1.0.1e 11 Feb 2013
But this is the patched version from Debian if you see below:
$ dpkg -s openssl
Package: openssl
Status: install ok installed
Priority: optional
Section: utils
Installed-Size: 1081
Maintainer: Debian OpenSSL Team <pkg-openssl-devel@lists.alioth.debian.org>
Architecture: amd64
Version: 1.0.1e-2+deb7u6
This is guess work on my end, but I guess it went like this: debian disabled the heartbeat extension in openssl and because its just an extension maybe they didnt have to produce a new build, which is why "openssl version" still reports the old build date because the fixed debian package doesnt actually contain a new build. this is really rather confusing but apparently you have to check via "dpkg -s openssl" (or dpkg --list or any other means through apt) whether or not you're sporting the fix whereas for redhat based systems "openssl version" will do.
On the plus side: the post-upgrade script for libssl in debian offers to automatically restart all the affected services (only the ones that ship with debian tho, so it wont restart pveproxy for you) whereas ubuntu just claims that you have to reboot your machine after updating...
On the plus side: the post-upgrade script for libssl in debian offers to automatically restart all the affected services (only the ones that ship with debian tho, so it wont restart pveproxy for you) whereas ubuntu just claims that you have to reboot your machine after updating...
mir, thank You for the tranquilizer
I should have read this before: http://www.debian.org/security/2014/dsa-2896 , especially the appropriate line (wheezy).