OS2 World Community Forum

OS/2, eCS & ArcaOS - Technical => Web applications => Topic started by: Paul Smedley on April 12, 2014, 03:02:13 am

Title: 'Heartbleed' vulnerability - OS/2 web server fixes
Post by: Paul Smedley on April 12, 2014, 03:02:13 am
Apache2, PHP 5.3.x, PHP 5.4.x, PHP 5.5.x updated to include OpenSSL 1.0.1g fixes that address 'Heart Bleed' vulnerability - http://os2ports.smedley.id.au
Title: Re: 'Heartbleed' vulnerability - OS/2 web server fixes
Post by: dbanet on April 12, 2014, 04:05:20 am
Thank you.

After I've checked RPM just after the vulnerability became available, and found that there is version 1.0.0a that is not vulnerable, and that I don't use SSL in Apache, I settled down and added the link to #netlabs topic.

I can't remember any other application that uses OpenSSL, but if it is, please say what one.
We should check that it uses the openssl.dll that ships via netlabs repository, or if it uses its own, that it is not vulnerable.
Title: Re: 'Heartbleed' vulnerability - OS/2 web server fixes
Post by: Dave Yeo on April 12, 2014, 04:24:54 am
Lots of applications use OpenSSL, I know I've distributed a few such as the Links web browser. Luckily I always used the old 0.98 which I believe is not vulnerable.
The real question is how many other vulnerabilities our American friends are keeping secret so they can read our stuff.
Title: Re: 'Heartbleed' vulnerability - OS/2 web server fixes
Post by: Ben on April 13, 2014, 07:55:00 pm

Hello, Dave

Quote
The real question is how many other vulnerabilities our American friends are keeping secret so they can read our stuff.

You might as well ask yourself the same thing about the entire Internet...

...and after that, ask yourself "what is the real reason why it was created?".

The "light" clicks on in some, (bright!), but not in most, (dull).

Title: Re: 'Heartbleed' vulnerability - OS/2 web server fixes
Post by: BigGoofyGuy on April 14, 2014, 04:35:54 pm
http://en.wikipedia.org/wiki/Internet (http://en.wikipedia.org/wiki/Internet)
I find this to be very informative on The Internet.  8)
(http://upload.wikimedia.org/wikipedia/commons/thumb/9/93/PikiWiki_Israel_32304_The_Internet_Messenger_by_Buky_Schwartz.JPG/250px-PikiWiki_Israel_32304_The_Internet_Messenger_by_Buky_Schwartz.JPG)

Quote
The real question is how many other vulnerabilities our American friends are keeping secret so they can read our stuff.
As an American, I have no idea what you are talking about.  :-X
 ;D
Title: Re: 'Heartbleed' vulnerability - OS/2 web server fixes
Post by: Dave Yeo on April 16, 2014, 03:53:29 am
The story that the NSA knew about this vulnerability for a couple of years and didn't tell anyone as it was handy for spying.
Title: Re: 'Heartbleed' vulnerability - OS/2 web server fixes
Post by: Greggory Shaw on April 16, 2014, 04:35:35 am
The story that the NSA knew about this vulnerability for a couple of years and didn't tell anyone as it was handy for spying.


Well, I'm pretty sure that the NSA doesn't have any problems getting around or through SSL in the first place ;)
Title: Re: 'Heartbleed' vulnerability - OS/2 web server fixes
Post by: Dave Yeo on April 16, 2014, 05:15:30 am
How? I can think of 3 possibilities.
Compromised keys allowing man in the middle attacks (mitm), quite possible for some sites, especially American ones, hard to do if I generate my own key.
Weak encryption algorithms,  most have been vetted by multiple outsiders and currently almost impossible to break and/or brute force with the one or two questionable ones not much used. In the past they forced most of the world to use weaker quality encryption but it has been a long time since browsers were split into domestic and the rest of the world. IIRC Netscape 2.2 was the last OS/2 browser that was split into secure and less secure. Problem with weak encryption is other intelligence agencies are just as capable of using the flaws.
Bugs such as the heartbeat vulnerability, also known as zero day exploits. Any the NSA are using may well be being used by other intelligence agencies and crooks and the longer they exist, the more chance that others will find them, especially with an open source library such as OpenSSL.  Of course it is also possible for someone to distributed buggy versions so if you don't build from trusted source you might have a flaw that most others don't. eg Paul could be a secret agent (or super crook) and his build has a vulnerability that he secretly added so trust comes into it again but he does make his toolchain available so someone else can download the source, build it the same way and compare binaries and this does happen with popular open source software.
Title: Re: 'Heartbleed' vulnerability - OS/2 web server fixes
Post by: Greg Pringle on April 25, 2014, 01:37:57 pm
I work with secure communications and encryption. I have a patent in encryption and live up the road from NIST and know some NSA encryption people. I can tell you that all public encryption is vulnerable. It does not matter what cypher is used because the public encryption is what passes the keys. The  best cypher in the world is no good if the keys can be read. There are techniques for breaking the public encryption that have nothing to do with knowing the keys. This current SSL bug only added a simple way for some people to breach systems.
Title: Re: 'Heartbleed' vulnerability - OS/2 web server fixes
Post by: dbanet on April 25, 2014, 06:43:54 pm
I can tell you that all public encryption is vulnerable.
Proof or gtfo?
Title: Re: 'Heartbleed' vulnerability - OS/2 web server fixes
Post by: Ian Manners on April 25, 2014, 08:30:09 pm
Boris, without saying anything I will agree with what Greg Pringle has said.

I'm also not going to say what I'm ex of, and I'm not an American but I have done many things in my short life in varied fields.
Title: Re: 'Heartbleed' vulnerability - OS/2 web server fixes
Post by: Doug Bissett on April 25, 2014, 11:01:05 pm
I can tell you that all public encryption is vulnerable.
Proof or gtfo?

I fully agree with Greg. I will further state that it is not just "public" encryption that is vulnerable. All encryption, of every type, is vulnerable. The only variables are how easy it is to break it, and how easy it is to get your hands on the encrypted files. Having source code available can also make it easier, if the interested party can determine exactly how a file might be encrypted, or if there might be a hole in the code (which was apparently the case with 'Heartbleed').

FWIW, I couldn't care less what NSA finds. What worries me more, is what the criminals are finding. A bank account number, and password, is gold to them. Hackers can also cause problems, but they often just want to show what they can do.
Title: Re: 'Heartbleed' vulnerability - OS/2 web server fixes
Post by: dbanet on April 26, 2014, 12:10:55 pm
Okay, I'm quitting this conversation  ;D