Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

Implication of applying patch / renew SSL cert on non-vulnerable Heart-Bleed OpenSSL versions

Posted on 2014-04-21
2
Medium Priority
?
452 Views
Last Modified: 2014-04-22
The vulnerable versions are 1.0.1 to 1.0.1f

I have 1.0.1g & 0.9.8 (& its branch versions)
as well asl 0.9.7d

Q1:
0.9.7d was not indicated as vulnerable or non-vul but I'm inclined to believe
it's not as the Heartbleed vulnerability appears to start to surface starting
from 1.0.1 (sort of coding flaw started at that time): is this assumption right?

Q2:
if a colleague accidentally applied patches on non-vulnerable versions,
what's the implication?  Or does it allow the patch in RHES/Solaris x86/
SuSE Linux to go through?  I don't have access to Linux to test this out.
0
Comment
Question by:sunhux
2 Comments
 
LVL 33

Accepted Solution

by:
Dave Howe earned 1000 total points
ID: 40014157
the "patch" should just be an upgrade to 1.0.1g - there WAS a temp patch which recompiled openssl (from source) with the flag OPENSSL_NO_HEARTBEATS asserted - if you recompile openssl with an unrecognised flag, it is just ignored.

So in either case, there is no significant impact (although going to the latest stable is rarely a bad thing :)
0
 
LVL 62

Assisted Solution

by:gheist
gheist earned 1000 total points
ID: 40014246
A1: still you have to patch such an old version for other vulnerabilities
A2: Just that those old versions got less other vulnerabilities.
0

Featured Post

When ransomware hits your clients, what do you do?

MSPs: Endpoint security isn’t enough to prevent ransomware.
As the impact and severity of crypto ransomware attacks has grown, Webroot has fought back, not just by building a next-gen endpoint solution capable of preventing ransomware attacks but also by being a thought leader.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Ransomware continues to be a growing problem for both personal and business users alike and Antivirus companies are still struggling to find a reliable way to protect you from this dangerous threat.
Join Greg Farro and Ethan Banks from Packet Pushers (http://packetpushers.net/podcast/podcasts/pq-show-93-smart-network-monitoring-paessler-sponsored/) and Greg Ross from Paessler (https://www.paessler.com/prtg) for a discussion about smart network …
Learn how to get help with Linux/Unix bash shell commands. Use help to read help documents for built in bash shell commands.: Use man to interface with the online reference manuals for shell commands.: Use man to search man pages for unknown command…
Learn how to navigate the file tree with the shell. Use pwd to print the current working directory: Use ls to list a directory's contents: Use cd to change to a new directory: Use wildcards instead of typing out long directory names: Use ../ to move…

916 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question