OpenSSL Security Vulnerability

Hi Wael,

The 'openssl version' is correct (0.9.8c). But not in php this is because it uses (i think) the /lib dir and uses the 0.9.7a version when rebuilding.
The libcrypto links are ok. Why should i remove and remake the links?

Should i use the with-ssl-dir when i configure php or can i just delete the 0.9.7a version from the /lib directory and rebuild?

kind regards

martijn
 
cannot upgrade openssl-0.9.8c

portsnap fetch
portsnap extract
portnsap update
cd /usr/ports/security/openssl
make install clean



mars# openssl version
OpenSSL 0.9.7e 25 Oct 2004
 
MartijnHOS said:
If you don't update openSSH, your connection won't break.


Kind regards,

martijn
Click to expand...

I updated openssh and also openssl at the same time and never was disconnected at any point of time. ;)
 
eymbo said:
I updated openssh and also openssl at the same time and never was disconnected at any point of time. ;)
Click to expand...


It can be a risk if you update openssh that the update proces fails and you cannot login anymore. That was Peter's question.
 
I updated the openssl and figuired I had to redo exim, I tried the rpm source build from the knowledgbase when I tired to install it said it depended on libcypto and it wasnt found
any ideas?
 
MartijnHOS said:
It can be a risk if you update openssh that the update proces fails and you cannot login anymore. That was Peter's question.
Click to expand...

I suppose that's true however wouldn't you be inside ssh to begin with and if ssh compile or the update process fails you'd still be logged on as the process is still loaded into the memory.

A yum remove openssh and yum install openssh would most probably gaurentee it fixed. ;)
 
Just as a side-note, this only affects RSA key's who's exponent is 3. We use 65537 for our exponents (the default) when generating keys for certificates.

John
 
For debian users:

Make sure you included "deb http://security.debian.org/ stable/updates main contrib" in your /etc/apt/sources.list

Then just do a:
apt-get update && apt-get install openssl

Check for your current version with:
apt-show-versions | grep openssl

version 0.9.7e-3sarge2 has fixed the bug.
 
Ok, that would be easy. Does anyone else has experience with updating OpenSSL via apt-get in Debian?
 
MartijnHOS said:
It can be a risk if you update openssh that the update proces fails and you cannot login anymore. That was Peter's question.
Click to expand...

In this case, you can always open another connection with telnet or netcat. ;)
 
fwpeter said:
Is it safe to update this when I'm using a SSH connection during the update?

Can't take a risk, box is too far away ;)
Click to expand...

allways use the screen function...

for example:

screen ./build all n

you can always get your session back even if ssh fails...
 
fwpeter said:
Ok, that would be easy. Does anyone else has experience with updating OpenSSL via apt-get in Debian?
Click to expand...

I just did an apt-get upgrade but it still has the old version:

apt-show-versions | grep openssl
openssl/stable uptodate 0.9.7e-3sarge2

Any clues here?
 
Ah ok sorry for my ignorance again, should've known that ;-) Also:

/usr/include# ls -al | grep openssl
drwxr-xr-x 2 root root 4096 2006-09-18 10:55 openssl

seems ok.

Thanks for all the help.
 
You must log in or register to reply here.
Back
Top