THANK YOU! 2024 Fundraising Completed - $2095 / $2000 CDN for the year, June/July Renewal. Paypal Donation Link US dollars
Site vulnerability to the Heartbleed SSL bug
- The Meal
- Posts: 28003
- Joined: Tue Oct 12, 2004 10:33 pm
- Location: 2005 Stanley Cup Champion
Site vulnerability to the Heartbleed SSL bug
Per the heartbleed chrome extension, OO is showing up as vulnerable to this Heartbleed vulnerability, as discussed in this EBG thread:
"Better to talk to people than communicate via tweet." — Elontra
- FishPants
- Server WhOOre
- Posts: 4665
- Joined: Fri Oct 15, 2004 1:38 pm
- Location: Canada
Re: Site vulnerability to the Heartbleed SSL bug
Appreciate the feedback, but that's not the case. I patched this on bug report/patch release.
Code: Select all
Looking for TLS extensions on https://www.octopusoverlords.com
ext 65281 (renegotiation info, length=1)
ext 00035 (session ticket, length=0)
ext 00015 (heartbeat, length=1) <-- Your server supports heartbeat. Bug is possible when linking against OpenSSL 1.0.1f or older. Let me check.
Actively checking if CVE-2014-0160 works: Your server appears to be patched against this bug.
Checking your certificate
Certificate has NOT been reissued since the 0day. <-- Your stuff may be compromised. Consider changing the certificate and passwords.
No.
- Pyperkub
- Posts: 23788
- Joined: Mon Dec 13, 2004 5:07 pm
- Location: NC- that's Northern California
Re: Site vulnerability to the Heartbleed SSL bug
Real link,as that link is kind of hidden in the colon, and requires wading through the muck to find the updated issue.The Meal wrote:Per the heartbleed chrome extension, OO is showing up as vulnerable to this Heartbleed vulnerability, as discussed in this EBG thread:
Meal are you trying to tell us something?
![Talk to the hand :hand:](./images/smilies/eusa/hand.gif)
Black Lives definitely Matter Lorini!
Also: There are three ways to not tell the truth: lies, damned lies, and statistics.
Also: There are three ways to not tell the truth: lies, damned lies, and statistics.
- IceBear
- Posts: 12519
- Joined: Sat Nov 13, 2004 5:58 pm
Re: Site vulnerability to the Heartbleed SSL bug
Earlier this morning the Chrome extension was giving a warning that this site was vulnerable. It's not doing it now for what it's worth
Edit: And suddenly it popped up twice when I went to the Bargin Bin subforum.
Edit: And suddenly it popped up twice when I went to the Bargin Bin subforum.
- Carpet_pissr
- Posts: 20166
- Joined: Thu Nov 04, 2004 5:32 pm
- Location: Columbia, SC
Re: Site vulnerability to the Heartbleed SSL bug
But does it matter (for this site)? It's not like we have billing information or personal data forms on here, right?
Or is the concern that the password used for OO could be compromised (for those that use the same password for other sites)?
Or is the concern that the password used for OO could be compromised (for those that use the same password for other sites)?
- IceBear
- Posts: 12519
- Joined: Sat Nov 13, 2004 5:58 pm
Re: Site vulnerability to the Heartbleed SSL bug
Yeah, I'm not too concerned as the only info here is my password that I don't use anywhere else...was just pointing it out that the tool is claiming it's vulnerable (but it can apparently give false positives from what I read somewhere)Carpet_pissr wrote:But does it matter (for this site)? It's not like we have billing information or personal data forms on here, right?
Or is the concern that the password used for OO could be compromised (for those that use the same password for other sites)?
- Pyperkub
- Posts: 23788
- Joined: Mon Dec 13, 2004 5:07 pm
- Location: NC- that's Northern California
Re: Site vulnerability to the Heartbleed SSL bug
Probably most important for Fishpants, Rip and other db/site admins. I've always assumed my password here was quite insecure.
Black Lives definitely Matter Lorini!
Also: There are three ways to not tell the truth: lies, damned lies, and statistics.
Also: There are three ways to not tell the truth: lies, damned lies, and statistics.
- IceBear
- Posts: 12519
- Joined: Sat Nov 13, 2004 5:58 pm
Re: Site vulnerability to the Heartbleed SSL bug
Yup... That's why I never even bothered getting keypass to generate one for me... Though I suppose I should... ![Smile :-)](./images/smilies/icon/smile.gif)
![Smile :-)](./images/smilies/icon/smile.gif)
- FishPants
- Server WhOOre
- Posts: 4665
- Joined: Fri Oct 15, 2004 1:38 pm
- Location: Canada
Re: Site vulnerability to the Heartbleed SSL bug
The tools being used are being saturated with requests -- when this first broke and some free online tools were available, some of my important sites were showing as vulnerable (and they were behind an F5 ASM) -- ends up that F5 version wasn't vulnerable anyways. Scanned it with Nexpose and all was good.
So take the chrome extension with a grain of salt, either you're running OpenSSL < 1.0.1g and vulnerable or you aren't, it won't change between page flips.
Appreciate the heads up though, never know when I'll be asleep at the switch and need a slap.
So take the chrome extension with a grain of salt, either you're running OpenSSL < 1.0.1g and vulnerable or you aren't, it won't change between page flips.
Appreciate the heads up though, never know when I'll be asleep at the switch and need a slap.
No.
- GreenGoo
- Posts: 42484
- Joined: Thu Oct 14, 2004 10:46 pm
- Location: Ottawa, ON
Re: Site vulnerability to the Heartbleed SSL bug
Nice job Fishpants! Although OO is a fairly low risk site in general =D
- Pyperkub
- Posts: 23788
- Joined: Mon Dec 13, 2004 5:07 pm
- Location: NC- that's Northern California
Re: Site vulnerability to the Heartbleed SSL bug
Don't forget that versions of OpenSSL prior to 1.0.1 are also not susceptible to heartbleed. We have a program used to dump data to a section of ice.gov, and for some reason, it would only work with certificates exported with a version of openssl 0.9.8.FishPants wrote:The tools being used are being saturated with requests -- when this first broke and some free online tools were available, some of my important sites were showing as vulnerable (and they were behind an F5 ASM) -- ends up that F5 version wasn't vulnerable anyways. Scanned it with Nexpose and all was good.
So take the chrome extension with a grain of salt, either you're running OpenSSL < 1.0.1g and vulnerable or you aren't, it won't change between page flips.
Appreciate the heads up though, never know when I'll be asleep at the switch and need a slap.
Black Lives definitely Matter Lorini!
Also: There are three ways to not tell the truth: lies, damned lies, and statistics.
Also: There are three ways to not tell the truth: lies, damned lies, and statistics.