3

I am running a server with CentOS 6.5, patched to recent openssl updates via yum update ssl and with indications the current version indeed has the patch to the vulnerability.

$ sudo rpm -q --changelog openssl | grep CVE-2014-0224
- fix CVE-2014-0224 fix that broke EAP-FAST session resumption support
- fix CVE-2014-0224 - SSL/TLS MITM vulnerability

However, a QUALYS lab scan (https://www.ssllabs.com/ssltest) indicates I'm vulnerable

This server is vulnerable to the OpenSSL CCS vulnerability (CVE-2014-0224) and exploitable. Grade set to F.

I'm at a loss - should I trust QUALYS or the centos distro and rpm flag? If not the distro, this should get raised with centos - my past bug reports on their site have languished - if this is serious, how to get real attention?

Note: we always restart all relevant services after patches.

|improve this question
  • 2
    is there a load balancer or any other system between qualys and your patched server that might be causing the finding? redirected ports? – schroeder♦ Mar 7 '15 at 6:14
  • 1
    In addition to checking the items @schroeder mentioned, do you possibly have a service using a statically linked version of OpenSSL, rather than the OS version? – Xander Mar 7 '15 at 14:15
  • @Xander I thought about that, and believe that may be the issue. Am investigating. – user3546411 Mar 9 '15 at 1:44
  • @Xander - I have verified all openssl libraries are patched. Both nessus and ssllabs, however, report we are vulnerable. – user3546411 Jul 4 '15 at 22:18
  • @schroeder nope - the server I am referring to is the front end that gets hit first. – user3546411 Jul 4 '15 at 22:19
3

If openssl was patched recently and you have not restarted all services which are using libssl you may have to reboot your machine in order to complete the openssl patching.

By running following command you can see what services are using libssl: 

lsof | grep -i libssl | grep DEL | awk '{print $1}' | sort | uniq
|improve this answer

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.