Computers

What is the HeartBleed vulnerability ?

Simply put, it's a security hole in the foundation libraries ( openssl ) of most modern Linux and UNIX applications. Several important applications in these operating systems rely on these libraries , most notably - apache's SSL mechanism.

What does this mean?
It means that any server using the vulnerable library - OpenSSL 1.0.1 through 1.0.1f (inclusive) has potentially been compromised, and all the data on it could have been silently stolen, including passwords, credit card numbers, the SSL certificates themselves and anything else on the server.

How to asses if a website is vulnerable ?
copy paste it's address here: http://filippo.io/Heartbleed/

 

How to asses you Linux server?

Run the command:

sudo lsof | egrep "libssl|libcrypto" | cut -f 1 -d " " | sort | uniq

This should give you a list of applications running that are linked to these libraries.

Now check for the libraries on the hard disk itself, since many applications come with their own packaged libraries:

sudo find / -name libssl\*; sudo find / -name libcrypto\*


on centos/redhat, run:

rpm -qa | grep openssl

and on Debian\Ubuntu:

dpkg -l | grep openssl

and compare the versions.

How to asses a whole network?

A nice network scanning tool that has been updated to find the heartbleed bug is "masscan":
http://blog.erratasec.com/2014/04/using-masscan-to-scan-for-heartbleed.html#.U0jupnWSwuk

You can use Nmap:
http://hackertarget.com/testing-heartbleed-with-the-nmap-nse-script/

Nagios has come up with a plug-in for this as well:
http://www.nagios.com/heartbleed-tester

Nessus
http://www.tenable.com/blog/tenable-facilitates-detection-of-openssl-vulnerability-using-nessus-and-nessus-perimeter

And a personal open source favorite - Openvas
https://gist.github.com/RealRancor/10140249

please note that some of these tools might not check other ports besides 443 (https).
 

How to fix it?

Remediation depends on the system being repaired, it could range from a simple yum or apt-get upgrade command, to a full distribution upgrade and adding a custom update repository. It is also important to regenerate all you private keys and get new certificates for any system found vulnerable. A few good links for different platforms are:

for Ubuntu:
http://discourse.ubuntu.com/t/the-heartbleed-bug/1607

for Centos 6:
http://lists.centos.org/pipermail/centos-announce/2014-April/020249.html

for AIX:
http://www.aixhealthcheck.com/blog?id=354

for HP-UX:
http://hpux.connect.org.uk/hppd/hpux/Languages/openssl-1.0.1g/

Solaris:
According to Oracle, Solaris is not vulnerable. ( http://support.oracle.com/rs?type=doc&id=1645479.1 )

Mysql:
http://www.mysqlperformanceblog.com/2014/04/08/openssl-heartbleed-cve-2014-0160/

PostgresSQL:
http://michael.otacoo.com/postgresql-2/testing-heartbleed-on-postgres/

MongoDB:
http://www.mongodb.com/blog/post/mongodb-response-heartbleed-openssl-vulnerability

CouchDB:
https://blogs.apache.org/couchdb/entry/couchdb_and_the_heartbleed_ssl