Löytyi sivusto, jossa on faktaa ja ohjeistus "Heartbeat" eli OpenSSL bugista:
http://heartbleed.com/
Sivusto suunnattu palvelinten ylläpitäjille, joiden vastuulla on tarvittaessa informoida palvelujensa käyttäjiä.
Pisti silmään mm. nämä kohdat:
____________________________
Q: Who found the Heartbleed Bug?
A: This bug was independently discovered by a team of security engineers (Riku, Antti and Matti) at Codenomicon...
Q: How widespread is this?
A: The most notable software using OpenSSL are the open source web servers like Apache and nginx. The combined market share of just those two out of the active sites on the Internet was over 66%...
Q: What versions of the OpenSSL are affected?
A: Status of different versions:
-> OpenSSL 1.0.1 through 1.0.1f (inclusive) are vulnerable
-> OpenSSL 1.0.1g is NOT vulnerable
-> OpenSSL 1.0.0 branch is NOT vulnerable
-> OpenSSL 0.9.8 branch is NOT vulnerable
Bug was introduced to OpenSSL in December 2011 and has been out in the wild since OpenSSL release 1.0.1 on 14th of March 2012.
OpenSSL 1.0.1g released on 7th of April 2014 fixes the bug.
Q: How about operating systems?
A: Some operating system distributions that have shipped with potentially vulnerable OpenSSL version:
- Debian Wheezy (stable), OpenSSL 1.0.1e-2 deb7u4
- Ubuntu 12.04.4 LTS, OpenSSL 1.0.1-4ubuntu5.11
- CentOS 6.5, OpenSSL 1.0.1e-15
- Fedora 18, OpenSSL 1.0.1e-4
- OpenBSD 5.3 (OpenSSL 1.0.1c 10 May 2012) and 5.4 (OpenSSL 1.0.1c 10 May 2012)
- FreeBSD 10.0 - OpenSSL 1.0.1e 11 Feb 2013
- NetBSD 5.0.2 (OpenSSL 1.0.1e)
- OpenSUSE 12.2 (OpenSSL 1.0.1c)
Operating system distribution with versions that are not vulnerable:
- Debian Squeeze (oldstable), OpenSSL 0.9.8o-4squeeze14
- SUSE Linux Enterprise Server
- FreeBSD 8.4 - OpenSSL 0.9.8y 5 Feb 2013
- FreeBSD 9.2 - OpenSSL 0.9.8y 5 Feb 2013
- FreeBSD 10.0p1 - OpenSSL 1.0.1g (At 8 Apr 18:27:46 2014 UTC)
- FreeBSD Ports - OpenSSL 1.0.1g (At 7 Apr 21:46:40 2014 UTC)
Q: Has this been abused in the wild?
A: We don't know. Security community should deploy TLS/DTLS honeypots that entrap attackers and to alert about exploitation attempts.
___________________________________
Mites se Ouppen Soossin eräs (§) lakipykälä pitikään sisällään ?
"Given enough _eyeballs_ all bugs are shallow"
or more formally:
Given a large enough beta-tester and co-developer base, almost every problem will be characterized quickly and the fix will be obvious to someone."
MOT
http://heartbleed.com/
Sivusto suunnattu palvelinten ylläpitäjille, joiden vastuulla on tarvittaessa informoida palvelujensa käyttäjiä.
Pisti silmään mm. nämä kohdat:
____________________________
Q: Who found the Heartbleed Bug?
A: This bug was independently discovered by a team of security engineers (Riku, Antti and Matti) at Codenomicon...
Q: How widespread is this?
A: The most notable software using OpenSSL are the open source web servers like Apache and nginx. The combined market share of just those two out of the active sites on the Internet was over 66%...
Q: What versions of the OpenSSL are affected?
A: Status of different versions:
-> OpenSSL 1.0.1 through 1.0.1f (inclusive) are vulnerable
-> OpenSSL 1.0.1g is NOT vulnerable
-> OpenSSL 1.0.0 branch is NOT vulnerable
-> OpenSSL 0.9.8 branch is NOT vulnerable
Bug was introduced to OpenSSL in December 2011 and has been out in the wild since OpenSSL release 1.0.1 on 14th of March 2012.
OpenSSL 1.0.1g released on 7th of April 2014 fixes the bug.
Q: How about operating systems?
A: Some operating system distributions that have shipped with potentially vulnerable OpenSSL version:
- Debian Wheezy (stable), OpenSSL 1.0.1e-2 deb7u4
- Ubuntu 12.04.4 LTS, OpenSSL 1.0.1-4ubuntu5.11
- CentOS 6.5, OpenSSL 1.0.1e-15
- Fedora 18, OpenSSL 1.0.1e-4
- OpenBSD 5.3 (OpenSSL 1.0.1c 10 May 2012) and 5.4 (OpenSSL 1.0.1c 10 May 2012)
- FreeBSD 10.0 - OpenSSL 1.0.1e 11 Feb 2013
- NetBSD 5.0.2 (OpenSSL 1.0.1e)
- OpenSUSE 12.2 (OpenSSL 1.0.1c)
Operating system distribution with versions that are not vulnerable:
- Debian Squeeze (oldstable), OpenSSL 0.9.8o-4squeeze14
- SUSE Linux Enterprise Server
- FreeBSD 8.4 - OpenSSL 0.9.8y 5 Feb 2013
- FreeBSD 9.2 - OpenSSL 0.9.8y 5 Feb 2013
- FreeBSD 10.0p1 - OpenSSL 1.0.1g (At 8 Apr 18:27:46 2014 UTC)
- FreeBSD Ports - OpenSSL 1.0.1g (At 7 Apr 21:46:40 2014 UTC)
Q: Has this been abused in the wild?
A: We don't know. Security community should deploy TLS/DTLS honeypots that entrap attackers and to alert about exploitation attempts.
___________________________________
Mites se Ouppen Soossin eräs (§) lakipykälä pitikään sisällään ?
"Given enough _eyeballs_ all bugs are shallow"
or more formally:
Given a large enough beta-tester and co-developer base, almost every problem will be characterized quickly and the fix will be obvious to someone."
MOT
Vastaukset 3
Vanhimmat
Mikä ihmeen Codenomicon ?
http://www.tekes.fi/tekes/tulokset-ja-vaikutukset/caset/2013/codenomicon-automatisoitua-tietoturvatestausta/
No, kohta ameriikkalaiset tulee ja ostaa puljun ettei tuu lisää tällaisia paljastuksia.
Hmm....†