Difference between revisions of "Vuln web cve-2014-0160"

From Atomicorp Wiki
Jump to: navigation, search
m (Next Steps)
m (Next Steps)
Line 30: Line 30:
 
* FTP (if configured to use SSL)
 
* FTP (if configured to use SSL)
 
* tortixd
 
* tortixd
 +
 +
If you use a control panel, check with your control panel vendor to see what other services you need to restart and the services names.  If you are really unsure, you can just reboot your server which of course will restart all of these services..  To restart a service that uses the Linux standard init system, for example if you wanted to restart tortixd, you would run this command as root:
 +
 +
service tortixd restart
  
 
Note: SSH does not use SSL
 
Note: SSH does not use SSL

Revision as of 19:31, 16 April 2014

Heartbleed OpenSSL vulnerability

This vulnerability means that your system is running a vulnerable version of openssl that is vulnerable to the Heartbleed Vulnerability. This vulnerability makes it possible for an attacker to steal information from memory on your server, remotely, including passwords, sensitive information and private SSL keys. This is a very serious vulnerability and means that TLS and SSL based connections on your system can be compromised by an attacker exposing any information being sent over these connections.

Next Steps

Step 1) Patch OpenSSL

To fix this vulnerability you need to upgrade openssl to a version that is not vulnerable to this hole. The follow list provides links to specific vendors websites with instructions to fix this vulnerability.

Step 2) Restart all services that use SSL

The follow is a partial list of all services that may use SSL

  • http/apache
  • http/nginx
  • http/litespeed
  • IMAP/POP servers
  • SMTP mail servers
  • control panels
  • file sharing applications
  • FTP (if configured to use SSL)
  • tortixd

If you use a control panel, check with your control panel vendor to see what other services you need to restart and the services names. If you are really unsure, you can just reboot your server which of course will restart all of these services.. To restart a service that uses the Linux standard init system, for example if you wanted to restart tortixd, you would run this command as root:

service tortixd restart

Note: SSH does not use SSL

Step 3) Rekey your servers

Because heartbleed can make it possible for an attacker to steal your private keys, it is recommended that your re-key your servers. Please contact your CA vendor for specific instructions to do this, as each CA vendor may have a different process.

Step 4) Optional: Add defense in depth to TLS to help mitigate potential future vulnerabilities

It is also recommended that you implement Perfect Forward Secrecy on your server to mitigate possible future vulnerabilities in the TLS protocol. Please see the PFS article for recommendations.

Outside references

http://heartbleed.com/

http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0160

https://isc.sans.edu/forums/diary/Heartbleed+vendor+notifications/17929

Personal tools