I just got a software update
openssl-1.0.1e-37. I believe it is a patch for HeartBleed. Given that it was widely reported that versions up to 1.0.1f are vulnerable, how can I verify this patch on my server without resorting to an external checker?
I was able to download this tool and put it on one of my systems so that I could test my hosts without an external checker:
The results were consistent with what I expected (dirty to clean after patching, and the one time it didn't clean up after patching, further investigation showed the tool was right and I hadn't patched every copy of the openssl library).
And by the way, what you're describing is incredibly common. Many distributions (RHEL in particular) backport patches without changing the old rev. Red Hat actually takes the cake for this one - openssl-1.0.1e-16.el6_5.4 is the bad old RPM, and openssl-1.0.1e-16.el6_5.7 is the fixed new RPM. Really, Red Hat? You couldn't have nudged -16 up to -17?
In answer to @question-overflow's comment, here's an excellent dissection of the issue including walkthrough of the code and links to full source.
Qualsys SSL Labs is currently testing for garbage return to detect HeartBleed and several other vulnerabilities found on web servers. It also tracks down some configurations that can cause serious problems with SSL/TLS security.