How does one go about installing this update on Ubuntu? "sudo apt-get upgrade openssl" didn't do it.
OpenSSL Security Advisory: TLS heartbeat read overrun
11–20 of 88 posts
Re: OpenSSL Security Advisory: TLS heartbeat read overrun
#12In case anyone was wondering why I wrote spiped...
Totally agreed on the over-complexity and un-securability of TLS, that too often is deployed where something simpler should be used instead.
However, wouldn't OpenSSH be the thing spiped replaces most of the times? And that has a better security track record (I mean, better than OpenSSL for sure).
Re: OpenSSL Security Advisory: TLS heartbeat read overrun
#13I wonder how many service providers with big OpenSSL deployments (cloudflare, google, facebook, etc.) will do the sane thing and roll their authenticity keys. I'm guessing zero.
(Assuming they are deployed in such a way that their long-term authenticity keys are in the memory space of the network service, and not kept on another system or HSM.)
Re: OpenSSL Security Advisory: TLS heartbeat read overrun
#14In case anyone was wondering why I wrote spiped...
Totally agreed on the over-complexity and un-securability of TLS, that too often is deployed where something simpler should be used instead. However, wouldn't OpenSSH be the thing spiped replaces most of the times? And that has a better security track record (I mean, better than OpenSSL for sure).
A lot of people are doing spiped-like things using stunnel.
Re: OpenSSL Security Advisory: TLS heartbeat read overrun
#15Ouch. Does this mean almost every Debian 7 web server out there is probably vulnerable to having its private data for supporting HTTPS compromised?
https://security-tracker.debian.org/tracker/CVE-2014-0160
If so, that must be an awful lot of web servers, with a horrendous cost for everyone to buy new certificates etc. if there's no reliable way to determine what if anything was compromised.
Would any of our resident security experts like to suggest best practices under such circumstances?
(Edit: It looks like the page I linked above has been updated and a patch is going into Wheezy security as I write this.)
(Edit 2: Confirmed that Wheezy security updates now include openssl 1.0.1e-2+deb7u5 and related libssl changes.)
Re: OpenSSL Security Advisory: TLS heartbeat read overrun
#16How does one go about installing this update on Ubuntu? "sudo apt-get upgrade openssl" didn't do it.
By either compiling & installing it with -DOPENSSL_NO_HEARTBEATS or waiting for the security fix to be backported by ubuntu devs. http://heartbleed.com/
Re: OpenSSL Security Advisory: TLS heartbeat read overrun
#17It should really be possible to easily detect what functionalities your deploy of OpenSSL is using and recompile only those.
Re: OpenSSL Security Advisory: TLS heartbeat read overrun
#18"Don't roll your own parsers" should really be up there with "Don't roll your own crypto". This advisory is scant on details, but this extension protocol[0] neither looks complex nor beyond mechanical code generation to me. Just simple enough to be dangerous. And it's pretty new, so this must be recently authored vulnerable code. [0] http://tools.ietf.org/html/draft-ietf-tls-dtls-heartbeat-04
Here's the commit for the fix: http://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=...
Re: OpenSSL Security Advisory: TLS heartbeat read overrun
#19Earlier quoted context omitted.
Totally agreed on the over-complexity and un-securability of TLS, that too often is deployed where something simpler should be used instead. However, wouldn't OpenSSH be the thing spiped replaces most of the times? And that has a better security track record (I mean, better than OpenSSL for sure).
A lot of people are doing spiped-like things using stunnel.
Oh. Sigh.
Re: OpenSSL Security Advisory: TLS heartbeat read overrun
#20So they managed to notify Cloudflare in advance, but not debian/ubuntu security teams?