• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 457
  • Last Modified:

Implication of applying patch / renew SSL cert on non-vulnerable Heart-Bleed OpenSSL versions

The vulnerable versions are 1.0.1 to 1.0.1f

I have 1.0.1g & 0.9.8 (& its branch versions)
as well asl 0.9.7d

Q1:
0.9.7d was not indicated as vulnerable or non-vul but I'm inclined to believe
it's not as the Heartbleed vulnerability appears to start to surface starting
from 1.0.1 (sort of coding flaw started at that time): is this assumption right?

Q2:
if a colleague accidentally applied patches on non-vulnerable versions,
what's the implication?  Or does it allow the patch in RHES/Solaris x86/
SuSE Linux to go through?  I don't have access to Linux to test this out.
0
sunhux
Asked:
sunhux
2 Solutions
 
Dave HoweSoftware and Hardware EngineerCommented:
the "patch" should just be an upgrade to 1.0.1g - there WAS a temp patch which recompiled openssl (from source) with the flag OPENSSL_NO_HEARTBEATS asserted - if you recompile openssl with an unrecognised flag, it is just ignored.

So in either case, there is no significant impact (although going to the latest stable is rarely a bad thing :)
0
 
gheistCommented:
A1: still you have to patch such an old version for other vulnerabilities
A2: Just that those old versions got less other vulnerabilities.
0

Featured Post

SMB Security Just Got a Layer Stronger

WatchGuard acquires Percipient Networks to extend protection to the DNS layer, further increasing the value of Total Security Suite.  Learn more about what this means for you and how you can improve your security with WatchGuard today!

Tackle projects and never again get stuck behind a technical roadblock.
Join Now