Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Heartbleed Bug

heartbleed.com

Post reply on HN
Print view View original

51–60 of 547 posts

Re: The Heartbleed Bug

#51

Post by phillmv »

Given the severity of this bug, the UX of the site is failing anyone who isn't a fulltime sysadmin.

Suggestion: big, bold TLDR ("The sky is falling. Check your OpenSSL version right now") with a link on what to do sorted by OS vendor.

Step 1: Here's a command to spit out your OpenSSL version. If it is the following string, go to step 2.

Step 2: Here's how to update your OpenSSL. Here are links to guides on reissuing keys.

Probably OK the whole remediation bit links to a wiki that gets updated as the various vendors push their patches.

Re: The Heartbleed Bug

#52

Post by MattHeard »

MartinMond wrote: post #20

As of now (21:04 UTC) this isn't fixed in Debian https://security-tracker.debian.org/tracker/CVE-2014-0160 nor Ubuntu http://people.canonical.com/~ubuntu-security/cve/2014/CVE-20... Got a long night ahead :/

Should the priority on the ubuntu-security page be higher than "Medium"?

Re: The Heartbleed Bug

#53

Post by [deleted] »

Dorian-Marie wrote: post #8
ineedtosleep wrote: post #4

A couple more data points: I'm running Fedora 19 and Arch on my main dev machines/VMs and as of this posting are considered up-to-date. Both are vulnerable: [Fedora19] $ openssl version OpenSSL 1.0.1e-fips 11 Feb 2013 [Arch] $ openssl version OpenSSL 1.0.1f 6 Jan 2014

Not affected directly on Mac OS: OpenSSL 0.9.8y 5 Feb 2013

[deleted]

Re: The Heartbleed Bug

#55

Post by aegiso »

whyleyc wrote: post #27
tptacek wrote: post #24

Earlier quoted context omitted.

The bug is in the handling of the TLS protocol itself (actually, in a little-used extension of TLS, the TLS Record Layer Heartbeat Protocol), and isn't exposed in applications that just use TLS for crypto primitives.

Sooo in layman's terms - we only need to be worrying about HTTPS and not SSH ?

Yes and no.

First off, TLS is crypto bread-and-butter that's used for a lot more than HTTPS. You're not out of the woods because you're not running a webserver.

Second, SSH itself doesn't use TLS; it has its own protocol, so sshd isn't vulnerable.

But third, read overflows like this can be escalated in countless ways to total compromise if some credential, key, canary, or such gets leaked. So just because sshd isn't vulnerable doesn't mean you're not screwed.

Re: The Heartbleed Bug

#56

Post by earless1 »

phillmv wrote: post #51

Given the severity of this bug, the UX of the site is failing anyone who isn't a fulltime sysadmin. Suggestion: big, bold TLDR ("The sky is falling. Check your OpenSSL version right now") with a link on what to do sorted by OS vendor. Step 1: Here's a command to spit out your OpenSSL version. If it is the following string, go to step 2. Step 2: Here's how to update your OpenSSL. Here are links to guides on reissuing…

On my CentOS boxes I ran 'yum list | grep openssl'

Re: The Heartbleed Bug

#57

Post by whyleyc »

This doesn't sound like "responsible disclosure" to me - how can Codenomicon dump this news when all the major Linux vendors don't have patches ready to go ?

Re: The Heartbleed Bug

#59

Post by [deleted] »

MartinMond wrote: post #20

As of now (21:04 UTC) this isn't fixed in Debian https://security-tracker.debian.org/tracker/CVE-2014-0160 nor Ubuntu http://people.canonical.com/~ubuntu-security/cve/2014/CVE-20... Got a long night ahead :/

[deleted]

Re: The Heartbleed Bug

#60

Post by nicomihalich »

ineedtosleep wrote: post #4

A couple more data points: I'm running Fedora 19 and Arch on my main dev machines/VMs and as of this posting are considered up-to-date. Both are vulnerable: [Fedora19] $ openssl version OpenSSL 1.0.1e-fips 11 Feb 2013 [Arch] $ openssl version OpenSSL 1.0.1f 6 Jan 2014

The Arch package is available in Testing. https://www.archlinux.org/packages/testing/i686/openssl/
Post reply on HN