Hacker News Reader

Comment by neals | Hacker News Reader

I have a few ubuntu servers. When I do a "check for heartbleed" check with various tools, it says they are not vulnerable. However, these servers were installed 6 months ago and not updated for at least 2 months. How can they not be vulnerable?

View on HN

Most reports about Heartbleed kept repeating that the vulnerability was introduced 2 years ago (Dec '12, which isn't even 2 years - but anyway) it was committed to a version of OpenSSL (v1.0.1) that wasn't widely distributed until the middle of last year.

The time surface of the Heartbleed attack is a lot smaller than what most think. Debian and the BSD projects moved to v1.0.1 earliest, around March/April last year.

Ubuntu only upgraded two months ago (in 12.04.4) on the 6th of Feb:

http://fridge.ubuntu.com/2014/02/06/ubuntu-12-04-4-lts-relea...

Redhat with 6.5 in November 2013:

https://access.redhat.com/site/documentation/en-US/Red_Hat_E...

CentOS Feb 26th 2014:

http://wiki.centos.org/Manuals/ReleaseNotes/CentOS6.5

Fedora has been on OpenSSL 1.0.1 since maybe March 14, 2012 (that was when the .spec was bumped, anyway)[0]. So quite a long window for Fedora users, unfortunately.

[0]: http://pkgs.fedoraproject.org/cgit/openssl.git/commit/?h=f18...

Whoah, downvote for this? I thought this was factual and helpful... if you disagree, can you at least let me know what's wrong? Thanks.

For more details: Fedora 18 shipped with OpenSSL 1.0.1c on 11-Sep-2012: http://mirrors.kernel.org/fedora/releases/18/Everything/x86_.... So that's 18 months of exposure for Fedora users (including me).

It's apparently Dec 2011 not Dec 2012, if we look at the date of the now famous commit:

http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=4817...

"Sat, 31 Dec 2011 22:59:57 +0000

Support for TLS/DTLS heartbeats. 20 files changed"

    > 2 years ago (Dec '12, which isn't even 2 years - but
    > anyway)

It was Dec 31 '11, not '12, that the commit was made--more than 2 years ago. It first appeared in the OpenSSL 1.0.1 release; March 14, 2012.

I don't know what's up with the timestamp on the Ubuntu announcement, but 12.04 was released in April 2012.

However, that's before the OpenSSL 1.0.1 date; the Ubuntu 12.04.4 update for openssl 1.0.1-2ubuntu1 came on March 22, 2012.

No matter how you slice it, that's more than 2 years.

Edit: Ubuntu 12.04 was April 2012, but the 12.04.4 point-release was released at the later date; that's where the 2014 date came from. 12.04 included OpenSSL 1.0.1 before that.

I am not an expert on the topic by any means, but one possibility is that older versions of impacted software are simply not vulnerable.

Yep, older versions of OpenSSL are not vulnerable.

Ok, so I am rewarded for not having an up-to-date system. How about that...

You might want to rely on some other tool to determine if you are vulnerable or not. Or, just fix it yourself:

http://www.ansoncheunghk.info/article/3-simple-steps-update-...

I ran some of the exploits that were floating around against my own servers and against known vulnerable servers. I got nothing from mine, but lots of scary stuff from the others.

> How can they not be vulnerable?

It very much depends which variant you have installed. 10.04 is not vulnerable at all as it runs with 0.98.something (with some backported fixes, not including the exploit). 12.04 was vulnerable (it carries OpenSSL v1.0.1). There is a very similar situation with Debian's OldStable and Stable, and no doubt with the stable/long-term-support releases from RedHat and everyone else.

It also depends what they are testing: some things might be complied against GNUTLS instead of OpenSSL. That has had a vulnerability in recent months too, but is completely unaffected by this one.

If you are not using HTTPS (or other TLS wrapped protocols) at all on those servers then you are never going to be susceptible to this particular attack at all. OpenSSH apprently does not use OpenSSL in a manner that exposes he problem, so if all you expose is HTTP and SSH then you are fine (though if your users are sending anything sensitive over plain HTTP they are at risk from other problems).

Some builds of nginx linked to earlier libssl releases. This sort of software-level rather than system-level version difference can explain why upgrading "openssl" packages may be insufficient to prevent attacks. Upgrade "libssl" also. To see which version of libssl your stack uses, see ldd and strings: http://nginx.com/blog/nginx-and-the-heartbleed-vulnerability...

Deleted comment

13.04 is vulnerable, just out of the support period of ubuntu (decreased from 18 months down to 6 months in 2013) - basically out of luck, either use a ppa, or upgrade to 13.10

http://fridge.ubuntu.com/2013/03/19/changes-in-ubuntu-releas...

As I understand 13.04 is just as vulnerable, but not mentioned in that security notice because it is unsupported (end of life).

Older versions of OpenSSL were not vulnerable. Noticable 10.04 is not vulnerable.

Maybe they use the GNU TLS library.

Are you http only?

no I've got SSL certificates and https set up

Reply on news.ycombinator.com