11–20 of 78 posts
I have a few ubuntu servers. When I do a "check for heartbleed" check with various tools, it says they are not vulnerable. However, these servers were installed 6 months ago and not updated for at least 2 months. How can they not be vulnerable?
[deleted]
I have a few ubuntu servers. When I do a "check for heartbleed" check with various tools, it says they are not vulnerable. However, these servers were installed 6 months ago and not updated for at least 2 months. How can they not be vulnerable?
[deleted]
http://fridge.ubuntu.com/2013/03/19/changes-in-ubuntu-releas...
Well, with the exploits for this vulnerability now showing up everywhere i almost feel bad for the people that still have not-patched servers lying around.
I have a few ubuntu servers. When I do a "check for heartbleed" check with various tools, it says they are not vulnerable. However, these servers were installed 6 months ago and not updated for at least 2 months. How can they not be vulnerable?
Are you http only?
I have a few ubuntu servers. When I do a "check for heartbleed" check with various tools, it says they are not vulnerable. However, these servers were installed 6 months ago and not updated for at least 2 months. How can they not be vulnerable?
I am not an expert on the topic by any means, but one possibility is that older versions of impacted software are simply not vulnerable.
I have a few ubuntu servers. When I do a "check for heartbleed" check with various tools, it says they are not vulnerable. However, these servers were installed 6 months ago and not updated for at least 2 months. How can they not be vulnerable?
You might want to rely on some other tool to determine if you are vulnerable or not. Or, just fix it yourself: http://www.ansoncheunghk.info/article/3-simple-steps-update-...
Ugh. In the old days the mantra of full-disclosure was "well, if we don't make exploit tools, then the vendors won't issue patches." And then it became "well, if we don't make exploit tools, then the sysadmins won't patch." Apparently the bar has sunk so low that people personally pushing out Snort rules on snort-users aren't actually catching all instances of the bug is the justification for releasing tools to steal private keys.
In reality, lots of people in the security community just like seeing chaos in the world, because it makes for even more news headlines and in their mind this increases the status of the security community. Then it's time for the post hoc justifications for their behavior.
Well, with the exploits for this vulnerability now showing up everywhere i almost feel bad for the people that still have not-patched servers lying around.
Feel no pity whatsoever for the sysadmins. Feel pity for the users, who are unwittingly using a vulnerable service.
This should be a useful tool on its own, but I wrote it primarily because the pattern-matching rules for Snort are inadequate. IDS vendors won't fix their stuff until I can prove they are inadequate. Ugh. In the old days the mantra of full-disclosure was "well, if we don't make exploit tools, then the vendors won't issue patches." And then it became "well, if we don't make exploit tools, then the sysadmins won't patc…
I agree though. Hard to argue that this particular security issue needed any extra attention in order to get it fixed.