Translated from 日本語 • View original Hello. This is Komiya.
I received an article saying that a critical bug in OpenSSL was discovered.
As expected, it seems to have a big impact, so I will record the relevant information.
A critical bug in OpenSSL has been discovered. Possible impact on a large part of the Internet | TechCrunch Japan
JVNVU#94401838: Information Disclosure Vulnerability in OpenSSL heartbeat Extension
The scope of influence is openssl-1.0.1~1.0.1f, so it is ironic that the site that is seriously up-to-date will be affected.
But I think it was good that the scope of influence was limited.
Our CentOS 6.5 and Amazon Linux environments were affected.
First, take a look below.
Sites that describe how to deal with it:
AWS - Hartbleed Bug Support for OpenSSL on EC2 Instances - Addressed
TLS heartbeat read overrun (CVE-2014-0160) in Qiita openssl | Ore no homepage
How to check the version
rpm -qa|grep openssl
Or
openssl version
That's what it feels like,
I checked whether there is a patch that fixes CVE-2014-0160 as follows.
rpm -q --changelog openssl |head
* May April 07 2014 Toma? Mraz <tmraz@redhat.com> 1.0.1e-16.7
- fix CVE-2014-0160 - information disclosure in TLS heartbeat extension
If not, yum update openssl
I restarted services that use OpenSSL, such as SSHD, CROND, and HTTPD.
service crond restart
By the way, if I hadn't restarted CROND, I would have gotten the following error.
Apr 8 15:24:01 nat02 crond[31612]: (root) FAILED to authorize user with PAM (Module is unknown)
It seems that it is a good idea to check whether the version of the library is used properly after the update as shown below.
# lsof -n | grep ssl
sendmail 1181 root mem REG 202,1 221568 6393 /usr/lib64/libssl3.so
sendmail 1181 root DEL REG 202,1 6243 /usr/lib64/libssl.so.1.0.1e
sendmail 1188 smmsp mem REG 202,1 221568 6393 /usr/lib64/libssl3.so
sendmail 1188 smmsp DEL REG 202,1 6243 /usr/lib64/libssl.so.1.0.1e
sshd 5890 root mem REG 202,1 221568 6393 /usr/lib64/libssl3.so
zabbix_ag 6147 zabbix DEL REG 202,1 6243 /usr/lib64/libssl.so.1.0.1e
zabbix_ag 6147 zabbix mem REG 202,1 221568 6393 /usr/lib64/libssl3.so
zabbix_ag 6148 zabbix DEL REG 202,1 6243 /usr/lib64/libssl.so.1.0.1e
zabbix_ag 6148 zabbix mem REG 202,1 221568 6393 /usr/lib64/libssl3.so
zabbix_ag 6149 zabbix DEL REG 202,1 6243 /usr/lib64/libssl.so.1.0.1e
zabbix_ag 6149 zabbix mem REG 202,1 221568 6393 /usr/lib64/libssl3.so
zabbix_ag 6150 zabbix DEL REG 202,1 6243 /usr/lib64/libssl.so.1.0.1e
zabbix_ag 6150 zabbix mem REG 202,1 221568 6393 /usr/lib64/libssl3.so
zabbix_ag 6151 zabbix DEL REG 202,1 6243 /usr/lib64/libssl.so.1.0.1e
zabbix_ag 6151 zabbix mem REG 202,1 221568 6393 /usr/lib64/libssl3.so
zabbix_ag 6152 zabbix DEL REG 202,1 6243 /usr/lib64/libssl.so.1.0.1e
zabbix_ag 6152 zabbix mem REG 202,1 221568 6393 /usr/lib64/libssl3.so
sshd 8212 root mem REG 202,1 221568 6393 /usr/lib64/libssl3.so
sshd 8214 isao-op mem REG 202,1 221568 6393 /usr/lib64/libssl3.so
sudo 8234 root mem REG 202,1 221568 6393 /usr/lib64/libssl3.so
# ls -lh /usr/lib64/libssl*
-rwxr-xr-x 1 root root 217K Feb 28 2013 /usr/lib64/libssl3.so
lrwxrwxrwx 1 root root 16 Apr 8 06:14 /usr/lib64/libssl.so.10 -> libssl.so.1.0.1e
-rwxr-xr-x 1 root root 427K Apr 7 23:41 /usr/lib64/libssl.so.1.0.1e
# service sendmail restart
# service zabbix-agent restart
If possible, I think you can restart the OS.
You can find out if it is vulnerable by searching on the following sites.
Test your server for Heartbleed (CVE-2014-0160)
I think that measures will be taken in the future where existing certificates and ELBs are used.
The Crosstrust page says that you should renew your certificate.
SSL Server Certificate Crosstrust — Notice Regarding Addressing OpenSSL 1.0.1 Vulnerability (The Heartbleed Bug)
I will add any new information as I get it.
4/9 postscript:
On the page below, there was a link to ELB's countermeasures, and it was written that "mitigation measures that did not require customer action were taken", and when I checked on the check site, it seemed to be supported.
Heartbleed ~ OpenSSL Vulnerability (CVE-2014-0160) Summary - Qiita
AWS Services Updated to Address OpenSSL Vulnerability
However, it seems that you also need to renew your certificate. AWS Solutions Architect Blog: How to Renew Your ELB SSL Certificate
For more information about certificates and affected operating systems, click here "CVE-2014-0160 OpenSSL Heartbleed Vulnerability Summary - Memo Okiba"It was also detailed on the page.
If you are exposing your server with an SSL certificate, you need to recreate the private key and reissue the certificate to revoke the previous certificate. This is because the private key may be taken away.
Twitter hashtag: #heartbleed. When I followed him, he was muttering with great momentum.
4/10 postscript:
Cisco's VPN client software (Cisco AnyConnect Secure Mobility Client) I thought it would be okay~ but it seemed that only the iOS version was affected.
Cisco Security Advisory: OpenSSL Heartbeat Extension Vulnerability in Multiple Cisco Products
Thank you for watching. /tmraz@redhat.com