So they managed to notify Cloudflare in advance, but not debian/ubuntu security teams?
They may have had someone involved in the research / identification and fix.
OpenSSL Security Advisory: TLS heartbeat read overrun
31–40 of 88 posts
Re: OpenSSL Security Advisory: TLS heartbeat read overrun
#32If your site is protected by CloudFlare (like HN is), you are automatically protected from this vulnerability (see: http://blog.cloudflare.com/staying-ahead-of-openssl-vulnerab... ).
Perhaps Cloudfare should note that the "up to 64kB" isn't entirely correct.
>>There is no total of 64 kilobytes limitation to the attack, that limit applies only to a single heartbeat. Attacker can either keep reconnecting or during an active TLS connection keep requesting arbitrary number of 64 kilobyte chunks of memory content until enough secrets are revealed.
Re: OpenSSL Security Advisory: TLS heartbeat read overrun
#33Apparent introduction of the bug: https://github.com/openssl/openssl/commit/bd6941cfaa31ee8a3f...
Re: OpenSSL Security Advisory: TLS heartbeat read overrun
#34How does one go about installing this update on Ubuntu? "sudo apt-get upgrade openssl" didn't do it.
The fix has now been released by Ubuntu, so you can upgrade via the normal methods (apt-get update && apt-get upgrade)
Re: OpenSSL Security Advisory: TLS heartbeat read overrun
#35In case anyone was wondering why I wrote spiped...
But isn't spiped mostly irrelevant here?
I mean, it's not a TLS replacement, as it's based on PSK (thus only useable between two mutually trusting peers like me and myself), not PKI.
Re: OpenSSL Security Advisory: TLS heartbeat read overrun
#36An Ubuntu update would be nice right about now. Outside of disabling everything that uses openssl or compiling a new one manually, there's not much I can do to secure my servers at this moment. Meanwhile, I'm guessing a lot of not so nice people are racing to scan IP ranges for this bug.
Looks like this being made publicly listed, they did get this CVE out now (I last checked that link around noon PST)
http://people.canonical.com/~ubuntu-security/cve/2014/CVE-20...
Re: OpenSSL Security Advisory: TLS heartbeat read overrun
#37An Ubuntu update would be nice right about now. Outside of disabling everything that uses openssl or compiling a new one manually, there's not much I can do to secure my servers at this moment. Meanwhile, I'm guessing a lot of not so nice people are racing to scan IP ranges for this bug.
Debian already updated: http://www.debian.org/security/2014/dsa-2896
Ubuntu should follow really soon, if not already.
Edit: Ubuntu updated: http://www.ubuntu.com/usn/usn-2165-1/
Re: OpenSSL Security Advisory: TLS heartbeat read overrun
#38[deleted]
Re: OpenSSL Security Advisory: TLS heartbeat read overrun
#39Re: OpenSSL Security Advisory: TLS heartbeat read overrun
#40In case anyone was wondering why I wrote spiped...
Totally agreed on the over-complexity and un-securability of TLS, that too often is deployed where something simpler should be used instead. However, wouldn't OpenSSH be the thing spiped replaces most of the times? And that has a better security track record (I mean, better than OpenSSL for sure).
> Totally agreed on the over-complexity and un-securability of TLS, that too often is deployed where something simpler should be used instead.
What would something simpler, less error-prone which would give the same benefits in a client-server connection?
EDIT: Spiped is one, I got it (I'm on it right now and might even use it actually on a side-project), anything else that we should know about? :-)