Since 1999

 

3 minutes estimated reading time.

OpenSSL Vulnerability, Patch 1.0.1 Immediately

—

Major Vulnerability, Action Required. A major vulnerability for OpenSSL 1.0.1 was announced today, April 7, 2014. The Heartbleed Bug, CVE-2014-0160, is a major vulnerability that may lead to secret key disclosure. A discussion of this vulnerability can be found on the Hacker News thread on the Heartbleed vulnerability.

The Heartbleed bug allows anyone on the Internet to read the memory of the systems protected by the vulnerable versions of the OpenSSL software. This compromises the secret keys used to identify the service providers and to encrypt the traffic, the names and passwords of the users and the actual content. This allows attackers to eavesdrop communications, steal data directly from the services and users and to impersonate services and users.

If you manage any server or system that uses OpenSSL, then you need to check the version and apply patches immediately.

Check your OpenSSL version

Run this command to do so: openssl version -a.

  • OpenSSL 1.0.1 through 1.0.1f (inclusive) are vulnerable
  • OpenSSL 1.0.1g is NOT vulnerable
  • OpenSSL 1.0.0 branch is NOT vulnerable
  • OpenSSL 0.9.8 branch is NOT vulnerable

Bug was introduced to OpenSSL in December 2011 and has been out in the wild since OpenSSL release 1.0.1 on 14th of March 2012. OpenSSL 1.0.1g released on 7th of April 2014 fixes the bug.

Install patches immediately

The major operating system vendors have released patches already. For example, on Ubuntu Linux Servers you can update with:

sudo apt-get update && sudo apt-get upgrade

Enable Perfect Forward Secrecy

Today is a good lesson in why Perfect Forward Secrecy, which uses the Ephemeral Diffie-Helman cipher suites is preferable.

Apache

For one example on how to enable this in Apache, see https://gist.github.com/rietta/10087732.

nginx

For nginx, see Security/Server Side TLS: nginx

Thanks to Andy Lindeman for this tip via:

Incident Response

It cannot be stressed how major this vulnerability is. Though the probability that vulnerable servers have actually been attacked may be low, because the attack pattern will not show up in regular logs, one should operate under the assumption that key material has been compromised.

A prudent incident response is to:

  1. Check all servers under your care or ownership for vulnerable versions of OpenSSL
  2. Apply updates to patch to a fixed version
  3. Re-roll your SSL Certificates by
    • Generate a new SSL private key and Certificate Signing Request (CSR)
    • Inform your Certificate Authority that your previous key has been compromised
    • Get your CA to replace your SSL with the new key and CSR
    • Update your server with the new credentials
  4. Turn on Perfect Forward Secrecy if you have not done so already.