Path: csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!feeder.erje.net!eu.feeder.erje.net!news.swapon.de!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail
From: Jolly Roger <jollyroger@pobox.com>
Newsgroups: comp.sys.mac.system
Subject: Re: BHeartbleed OpenSSL vulnerability
Date: 8 Apr 2014 20:26:00 GMT
Organization: People for the Ethical Treatment of Pirates
Lines: 30
Message-ID: <bqj4anFdcaU2@mid.individual.net>
References: <534459ac$0$35014$c3e8da3$460562f1@news.astraweb.com>
X-Trace: individual.net rKy7b86Lhjn4+BeAGKGEKQoASLBC4MKh+AAxAXKsxTgiAqSPtv
Cancel-Lock: sha1:+LPzbqwErbzSCvOladowQcbylbs=
X-Face: _.g>n!a$f3/H3jA]>9pN55*5<`}Tud57>1<n@LQ!aZ7vLO_nWbK~@T'XIS0,oAJcU.qLM dk/j8Udo?O"o9B9Jyx+ez2:B<nx(k3EdHnTvB]'eoVaR495,Rv~/vPa[e^JI+^h5Zk*i`Q;ezqDW< ZFs6kmAJWZjOH\8[$$7jm,Ogw3C_%QM'|H6nygNGhhl+@}n30Nz(^vWo@h>Y%b|b-Y~()~\t,LZ3e up1/bO{=-)
User-Agent: slrn/1.0.1 (Darwin)
Xref: csiph.com comp.sys.mac.system:58400

On 2014-04-08, JF Mezei <jfmezei.spamnot@vaxination.ca> wrote:
> As you may have heard, a major vulnerability has been discovered with
> OpenSSL.
>
> From the command line: "openssl version" gives you the version.
>
> Snow Leopard has 0.9 so it is safe.
>
> 1.00 and 1.01 are vulnerable. You need 1.01g to fix it. (there are
> various flavours of 1.01 , not sure if openssl version provides the
> flavour or just 1.01)
>
> Not sure if Apple provided more recent versions of OpenSSL sicne Snow
> Leopard
>
> This vulnerability affects OpenSSL only in server mode, not in client mode.
>
> And since Apple widthdrew from the server business during Snow Leopard
> era, there are likely not many servers that run later versions of OS-X
> (other than home servers which serve files and not really internet facing)

More info - including a way to test your own server - here:

<http://filippo.io/Heartbleed/>

-- 
E-mail sent to this address may be devoured by my ravenous SPAM filter.
I often ignore posts from Google. Use a real news client instead.

JR