Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.sys.mac.system > #58399 > unrolled thread

BHeartbleed OpenSSL vulnerability

Back to article view | Back to comp.sys.mac.system

Contents

  BHeartbleed OpenSSL vulnerability JF Mezei <jfmezei.spamnot@vaxination.ca> - 2014-04-08 16:18 -0400
    Re: BHeartbleed OpenSSL vulnerability Jolly Roger <jollyroger@pobox.com> - 2014-04-08 20:26 +0000
    Re: BHeartbleed OpenSSL vulnerability JF Mezei <jfmezei.spamnot@vaxination.ca> - 2014-04-08 16:27 -0400
    Re: BHeartbleed OpenSSL vulnerability billy@MIX.COM - 2014-04-08 22:18 +0000
      Re: BHeartbleed OpenSSL vulnerability Tim McNamara <timmcn@bitstream.net> - 2014-04-08 18:53 -0500
        Re: BHeartbleed OpenSSL vulnerability Joanna Shuttleworth <js@example.com> - 2014-04-09 00:00 +0000
          Re: BHeartbleed OpenSSL vulnerability Tim McNamara <timmcn@bitstream.net> - 2014-04-08 23:20 -0500
            Re: BHeartbleed OpenSSL vulnerability David Ritz <dritz@mindspring.com> - 2014-04-09 07:56 -0500
          Re: BHeartbleed OpenSSL vulnerability billy@MIX.COM - 2014-04-10 06:08 +0000
        Re: BHeartbleed OpenSSL vulnerability Jolly Roger <jollyroger@pobox.com> - 2014-04-09 00:50 +0000
    Re: BHeartbleed OpenSSL vulnerability Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-04-16 13:18 +0000

#58399 — BHeartbleed OpenSSL vulnerability

As you may have heard, a major vulnerability has been discovered with
OpenSSL.

From the command line: "openssl version" gives you the version.

Snow Leopard has 0.9 so it is safe.

1.00 and 1.01 are vulnerable. You need 1.01g to fix it. (there are
various flavours of 1.01 , not sure if openssl version provides the
flavour or just 1.01)

Not sure if Apple provided more recent versions of OpenSSL sicne Snow
Leopard

This vulnerability affects OpenSSL only in server mode, not in client mode.

And since Apple widthdrew from the server business during Snow Leopard
era, there are likely not many servers that run later versions of OS-X
(other than home servers which serve files and not really internet facing)

[toc] | [next] | [standalone]

#58400

On 2014-04-08, JF Mezei <jfmezei.spamnot@vaxination.ca> wrote:
> As you may have heard, a major vulnerability has been discovered with
> OpenSSL.
>
> From the command line: "openssl version" gives you the version.
>
> Snow Leopard has 0.9 so it is safe.
>
> 1.00 and 1.01 are vulnerable. You need 1.01g to fix it. (there are
> various flavours of 1.01 , not sure if openssl version provides the
> flavour or just 1.01)
>
> Not sure if Apple provided more recent versions of OpenSSL sicne Snow
> Leopard
>
> This vulnerability affects OpenSSL only in server mode, not in client mode.
>
> And since Apple widthdrew from the server business during Snow Leopard
> era, there are likely not many servers that run later versions of OS-X
> (other than home servers which serve files and not really internet facing)

More info - including a way to test your own server - here:

<http://filippo.io/Heartbleed/>

-- 
E-mail sent to this address may be devoured by my ravenous SPAM filter.
I often ignore posts from Google. Use a real news client instead.

JR

[toc] | [prev] | [next] | [standalone]

#58401

Correction: affected version ate 1.01 to 1.01f (g fixes it).

some more info:

OpenSSL Security Advisory [07 Apr 2014]
========================================

TLS heartbeat read overrun (CVE-2014-0160)
==========================================

A missing bounds check in the handling of the TLS heartbeat extension can be
used to reveal up to 64k of memory to a connected client or server.

Only 1.0.1 and 1.0.2-beta releases of OpenSSL are affected including
1.0.1f and 1.0.2-beta1.

Thanks for Neel Mehta of Google Security for discovering this bug and to
Adam Langley <agl@chromium.org> and Bodo Moeller <bmoeller@acm.org> for
preparing the fix.

Affected users should upgrade to OpenSSL 1.0.1g. Users unable to immediately
upgrade can alternatively recompile OpenSSL with -DOPENSSL_NO_HEARTBEATS.

1.0.2 will be fixed in 1.0.2-beta2.


also:

openssl version -a    provides greater info on the build.

Snow Leopard:
 openssl version -a
OpenSSL 0.9.8y 5 Feb 2013
built on: Jun 27 2013
platform: darwin64-x86_64-llvm
options:  bn(64,64) md2(int) rc4(ptr,char) des(idx,cisc,16,int)
blowfish(ptr2)
compiler: -arch x86_64 -fmessage-length=0 -pipe -Wno-trigraphs
-fpascal-strings -fasm-blocks -O3 -D_REENTRANT -DDSO_DLFCN
-DHAVE_DLFCN_H -DL_ENDIAN -DMD32_REG_T=int -DOPENSSL_NO_IDEA
-DOPENSSL_PIC -DOPENSSL_THREADS -DZLIB -mmacosx-version-min=10.6
OPENSSLDIR: "/System/Library/OpenSSL"

[toc] | [prev] | [next] | [standalone]

#58409

JF Mezei <jfmezei.spamnot@vaxination.ca> writes:

> As you may have heard, a major vulnerability has been discovered with
> OpenSSL.

> Snow Leopard has 0.9 so it is safe.

OS 10.9.2 is supplied with OpenSSL 0.9.8y 5 Feb 2013.

Billy Y..
-- 
        sub     #'9+1   ,r0             ; convert ascii byte
	add     #9.+1   ,r0             ; to an integer
	bcc     20$                     ; not a number

[toc] | [prev] | [next] | [standalone]

#58411

On Tue, 8 Apr 2014 22:18:25 +0000 (UTC), billy@MIX.COM <billy@MIX.COM> 
wrote:
> JF Mezei <jfmezei.spamnot@vaxination.ca> writes:
>
>> As you may have heard, a major vulnerability has been discovered with 
>> OpenSSL.
>
>> Snow Leopard has 0.9 so it is safe.
>
> OS 10.9.2 is supplied with OpenSSL 0.9.8y 5 Feb 2013.

Mine Mac with 10.9.2 has 1.0.1f 6 Jan 2014 by contrast to your report.

[toc] | [prev] | [next] | [standalone]

#58412

On 2014-04-08, Tim McNamara <timmcn@bitstream.net> wrote:
> On Tue, 8 Apr 2014 22:18:25 +0000 (UTC), billy@MIX.COM <billy@MIX.COM> 
> wrote:
>> JF Mezei <jfmezei.spamnot@vaxination.ca> writes:
>>
>>> As you may have heard, a major vulnerability has been discovered with 
>>> OpenSSL.
>>
>>> Snow Leopard has 0.9 so it is safe.
>>
>> OS 10.9.2 is supplied with OpenSSL 0.9.8y 5 Feb 2013.
>
> Mine Mac with 10.9.2 has 1.0.1f 6 Jan 2014 by contrast to your report.

You may have another openssl from such as Macports; the Apple-supplied
version can be found with

/usr/bin/openssl version

and, yes, the client version can leak stuff under some circumstances...

Jo

[toc] | [prev] | [next] | [standalone]

#58416

On 09 Apr 2014 00:00:25 GMT, Joanna Shuttleworth <js@example.com> wrote:
> On 2014-04-08, Tim McNamara <timmcn@bitstream.net> wrote:
>> On Tue, 8 Apr 2014 22:18:25 +0000 (UTC), billy@MIX.COM 
>> <billy@MIX.COM> wrote:
>>> JF Mezei <jfmezei.spamnot@vaxination.ca> writes:
>>>
>>>> As you may have heard, a major vulnerability has been discovered 
>>>> with OpenSSL.
>>>
>>>> Snow Leopard has 0.9 so it is safe.
>>>
>>> OS 10.9.2 is supplied with OpenSSL 0.9.8y 5 Feb 2013.
>>
>> Mine Mac with 10.9.2 has 1.0.1f 6 Jan 2014 by contrast to your 
>> report.
>
> You may have another openssl from such as Macports; the Apple-supplied 
> version can be found with
>
> /usr/bin/openssl version
>
> and, yes, the client version can leak stuff under some 
> circumstances...

Good catch, I do have MacPorts installed.  /usr/bin/openssl version 
reports:

OpenSSL 0.9.8y 5 Feb 2013

[toc] | [prev] | [next] | [standalone]

#58421

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Tuesday, 08 April 2014 23:20 -0500, 
 in article <slrnlk9ikd.2h24.timmcn@sugaree.local>, 
 Tim McNamara <timmcn@bitstream.net> wrote:

> On 09 Apr 2014 00:00:25 GMT, Joanna Shuttleworth <js@example.com> wrote:

>> On 2014-04-08, Tim McNamara <timmcn@bitstream.net> wrote:

>>> On Tue, 8 Apr 2014 22:18:25 +0000 (UTC), billy@MIX.COM 
>>> <billy@MIX.COM> wrote:

>>>> JF Mezei <jfmezei.spamnot@vaxination.ca> writes:

>>>>> As you may have heard, a major vulnerability has been discovered 
>>>>> with OpenSSL.

>>>>> Snow Leopard has 0.9 so it is safe.

>>>> OS 10.9.2 is supplied with OpenSSL 0.9.8y 5 Feb 2013.

>>> Mine Mac with 10.9.2 has 1.0.1f 6 Jan 2014 by contrast to your 
>>> report.

>> You may have another openssl from such as Macports; the 
>> Apple-supplied version can be found with

>> /usr/bin/openssl version

>> and, yes, the client version can leak stuff under some 
>> circumstances...

> Good catch, I do have MacPorts installed.  /usr/bin/openssl version 
> reports:

> OpenSSL 0.9.8y 5 Feb 2013

Darwin Kernel Version 13.1.0:

    $ /usr/bin/openssl version
    OpenSSL 0.9.8y 5 Feb 2013

    $ /opt/local/bin/openssl version
    OpenSSL 1.0.1g 7 Apr 2014

- -- 
David Ritz <dritz@mindspring.com>
 Be kind to animals; kiss a shark.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (Darwin)

iEYEARECAAYFAlNFQ2IACgkQUrwpmRoS3uvsawCg0VLoHonSbsDj7ZCzNKIRYqKI
dc0An1KhnEtS2QAUJgglkyS8BCU8Ajyg
=mLh4
-----END PGP SIGNATURE-----

[toc] | [prev] | [next] | [standalone]

#58446

Joanna Shuttleworth <js@example.com> writes:

> and, yes, the client version can leak stuff under some circumstances...

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140409-heartbleed

| The vulnerability is due to a missing bounds check in the handling of
| the Transport Layer Security (TLS) heartbeat extension.  An attacker
| could exploit this vulnerability by implementing a malicious TLS or
| Datagram Transport Layer Security (DTLS) client, if trying to exploit
| the vulnerability on an affected server, or a malicious TLS or DTLS
| server, if trying to exploit the vulnerability on an affected client.
| An exploit could send a specially crafted TLS or DTLS heartbeat packet
| to the connected client or server.  An exploit could allow the attacker
| to disclose a limited portion of memory from a connected client or
| server for every heartbeat packet sent.  The disclosed portions of
| memory could contain sensitive information that may include private
| keys and passwords.

Billy Y..
-- 
        sub     #'9+1   ,r0             ; convert ascii byte
	add     #9.+1   ,r0             ; to an integer
	bcc     20$                     ; not a number

[toc] | [prev] | [next] | [standalone]

#58413

On 2014-04-08, Tim McNamara <timmcn@bitstream.net> wrote:
> On Tue, 8 Apr 2014 22:18:25 +0000 (UTC), billy@MIX.COM <billy@MIX.COM> 
> wrote:
>> JF Mezei <jfmezei.spamnot@vaxination.ca> writes:
>>
>>> As you may have heard, a major vulnerability has been discovered with 
>>> OpenSSL.
>>
>>> Snow Leopard has 0.9 so it is safe.
>>
>> OS 10.9.2 is supplied with OpenSSL 0.9.8y 5 Feb 2013.
>
> Mine Mac with 10.9.2 has 1.0.1f 6 Jan 2014 by contrast to your report.

Hmmm... I just checked two of my Macs, both running Mac OS X 10.9.2 with Mac OS
X Server installed and reporting "No updates available" in Software
Update; both machines report:

OpenSSL 0.9.8y 5 Feb 2013

-- 
E-mail sent to this address may be devoured by my ravenous SPAM filter.
I often ignore posts from Google. Use a real news client instead.

JR

[toc] | [prev] | [next] | [standalone]

#58562

In message <534459ac$0$35014$c3e8da3$460562f1@news.astraweb.com> 
  JF Mezei <jfmezei.spamnot@vaxination.ca> wrote:
> As you may have heard, a major vulnerability has been discovered with
> OpenSSL.

> From the command line: "openssl version" gives you the version.

> Snow Leopard has 0.9 so it is safe.

> 1.00 and 1.01 are vulnerable. You need 1.01g to fix it. (there are
> various flavours of 1.01 , not sure if openssl version provides the
> flavour or just 1.01)

OS X is on the BSD branch, 0.9.8 (0.9.8y in my case) and is not
vulnerable. Of course, that is only relevant if you are running a
server. You updating openSSL will not make the sites you visit any more
secure.

> Not sure if Apple provided more recent versions of OpenSSL sicne Snow
> Leopard

FTR, 0.9.8 is JUST as recent as 1.0.1, just different branches.

> And since Apple widthdrew from the server business during Snow Leopard
> era, there are likely not many servers that run later versions of OS-X
> (other than home servers which serve files and not really internet facing)

There are a LOT of Mac minis acting as servers.

-- 
"If I only had a little humility, I'd be perfect."

[toc] | [prev] | [standalone]

Back to top | Article view | comp.sys.mac.system

csiph-web