Heartbleed Bug: OpenSSL Security Flaw
Security researchers have announced a bug in the OpenSSL library versions 1.0.1–1.0.1f and 1.0.2beta, named Heartbleed (CVE-2014-0160).
The bug lets an attacker send a malformed heartbeat message to a target, which returns data stored in memory. Each attack can retrieve 64 kilobytes, but repeated attacks may collect all the desired information, such as personal information.
If the attacker obtains private encryption keys, they can easily encrypt and decrypt data. They can then intercept communications between the server whose keys were stolen and its clients at any time, even after the bug is fixed. The only solution is to reissue the certificate.
Affected and unaffected OpenSSL versions
- OpenSSL 1.0.1 through 1.0.1f => vulnerable
- OpenSSL 1.0.1g => NOT vulnerable
- OpenSSL 1.0.0 branch => NOT vulnerable
- OpenSSL 0.9.8 branch => NOT vulnerable
Affected operating systems by distribution
- Debian Wheezy (stable), OpenSSL 1.0.1e-2+deb7u4
- Ubuntu 12.04.4 LTS, OpenSSL 1.0.1-4ubuntu5.11
- CentOS 6.5, OpenSSL 1.0.1e-15
- Fedora 18, OpenSSL 1.0.1e-4
- OpenBSD 5.3 (OpenSSL 1.0.1c 10 May 2012) and 5.4 (OpenSSL 1.0.1c 10 May 2012)
- FreeBSD 10.0 - OpenSSL 1.0.1e 11 Feb 2013
- NetBSD 5.0.2 (OpenSSL 1.0.1e)
- OpenSUSE 12.2 (OpenSSL 1.0.1c)
Fix the OpenSSL security flaw Update OpenSSL to version 1.0.1g, or update the distribution’s openssl package to these versions:
- 1.0.1e-2+deb7u5 on Debian
- 1.0.1e-16.el6_5.7 on Red Hat 6 / CentOS 6
- 1.0.1-4ubuntu5.12 on Ubuntu 12.04 LTS
- 1.0.1e-37.66 on Amazon AMI
OpenSSL Heartbeat (Heartbleed) Vulnerability (CVE-2014-0160)
