Thursday, April 10, 2014

OpenSSL Release Critical Security Update to Fix "Heartbeat' Vulnerability

Summary:
A serious vulnerability in the popular OpenSSL cryptographic library has been discovered that allows attackers to steal information unnoticed. Known as the Heartbleed bug,

Impact:
The vulnerability allows anyone on the Internet to read the memory of systems that run vulnerable versions of OpenSSL, revealing the secret authentication and encryption keys to protect the traffic.
User names, passwords and the actual content of the communications can also be read.
According to the report, The exploit leave no trace that your server had been scanned and sensitive information leaked. 

If you had use the vulnerable version of the OpenSSL to generate encryption keys to secure your web traffic, your site is likely be affected.

In addition, tools had been released and out on the internet for users to scan sites that are vulnerable.

Only 1.0.1 and 1.0.2-beta releases of OpenSSL are affected including 1.0.1f and 1.0.2-beta1.

Solution:
OpenSSL 1.0.1g has been released to address this vulnerability.
Any keys generated with a vulnerable version of OpenSSL is likely be considered compromised and regenerated and deployed after the patch has been applied.

For more information: please refer to the links below

References:
Posted by at
Labels:

No comments:

Post a Comment

Subscribe to: Post Comments (Atom)