1

I'm getting ready to patch my server (Debian Wheezy), and it's going to be a pain because I built a lot of it from source (Apache 2.4, PHP, MySQL).

Before I get started patching, I'd like to have a better understanding of which OpenSSL services are vulernarable to the leak. Obviously HTTP/HTTPS services are vulnerable. What about SMTP, IMAP and POP? SSH? Or is it any public-facing service that uses the affected versions of OpenSSL I should be aware of?

My server also has IPMI/KVM (Supermicro) that I use to install my OS. It's accessible via HTTP/HTTPS on the same machine, but with a different IP address. I wonder if this is also vulnerable. I'm not sure if the built-in Supermicro web server uses OpenSSL. If so, I may ask my server provider to apply any firmware patches.

  • 1
    Unless you statically linked everything, you only need to upgrade the library. – Patrick Jun 24 '14 at 18:26
  • You can assume it's anything using openssl, client or server for communication over SSL/TLS or DTLS. – Stéphane Chazelas Jun 24 '14 at 19:51
3

Obviously HTTP/HTTPS services are vulnerable.

Only the later ;)

What about SMTP, IMAP and POP?

There are online and offline tests around for mailservers (and webservers). If you are running debian, there's a decent chance your software was compiled with a version of openSSL < 1.0.1, which is when the vulnerability starts, so if the binary was statically compiled (see below), check it first this way if you don't want to bother rebuilding.

SSH?

SSH doesn't use that feature so was not affected.

Beware that on debian, simply replacing the shared library is not enough, since for whatever reason, some openSSL enabled server thingies appear to have been statically linked. To check, run ldd on the binary. If you know that the application uses SSL/TLS and there is no link given to either libssl or libgnutls, then it was compiled in. If it fails one of the heartbleed tests, the whole app must be rebuilt.

  • I didn't compile my mail servers from source, I'm just using the stock Debian Wheezy binaries. I'm almost certain they were compiled with openSSL 1.0.1e (vulnerable). So correct me if I'm wrong, but to upgrade my mail server components it should be as easy as apt-get update, apt-get upgrade. As for Apache2.4, PHP, MySQL, I'm pretty sure I'll need to recompile against the latest libssl-dev (>= 1.0.1g). It's a relief to find out SSH wasn't affected. Thanks for that info and the testing links. – Jeff Jun 24 '14 at 19:06
  • You might as well go with 1.0.1h, since some more (less significant) issues were fixed earlier this month. It's getting a lot more positive scrutiny and assistance now, I imagine. – goldilocks Jun 24 '14 at 19:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.