quickhostuk
As your partner in online security, we want to keep you up-to-date with this new security development:
Earlier this morning OpenSSL released a security patch to fix a new vulnerability discovered in OpenSSL versions 1.0.2 and 1.0.1. This patch fixes one high severity vulnerability.
During certificate verification, OpenSSL (starting from version 1.0.1n and 1.0.2b) will attempt to find an alternative certificate chain if the first attempt to build such a chain fails. An error in the implementation of this logic can mean that an attacker could cause certain checks on untrusted certificates to be bypassed, such as the CA flag, enabling them to use a valid leaf certificate to act as a CA and “issue” an invalid certificate.
What’s the Impact?
The vulnerability appears to exist only in OpenSSL releases that happened in June 2015 and later. Because of this, the vulnerability only affects a limited set of OpenSSL versions: OpenSSL versions 1.0.2c, 1.0.2b, 1.0.1n and 1.0.1o.
Red Hat, CentOS, Debian, and Ubuntu have released notices stating that their distributions are not affected by this vulnerability since they were not utilising the latest version of OpenSSL.
What Should I Do?
Administrators should update their instances of OpenSSL:
• OpenSSL 1.0.2b/1.0.2c users should upgrade to 1.0.2d
• OpenSSL 1.0.1n/1.0.1o users should upgrade to 1.0.1p
Note: The bug does not affect OpenSSL versions 1.0.0 and 0.9.8.
Source code is available for the OpenSSL patches here.
If you are not a QuickHostUK Managed Hosting customer please ensure you have also taken the appropriate actions to secure your own servers. Alternatively, we can handle this for you with our adhoc management scheme, which for this occurrence would be £25 inc VAT per server.
Please contact us if you wish to utilise this service or if you have any questions.
Clients should update their web browsers as soon as new versions are released.
–EOF (The Ultimate Computing & Technology Blog) —
loading...
Last Post: Creating Sitemap Generator for PHPBB3.1 using PHP
Next Post: Faster than Faster - TP-LINK TL-WN822N 300MBPS High Gain Wireless N USB Adapter
