On 04/28/14 20:13, Tom Wijsman wrote:
On Mon, 28 Apr 2014 10:02:52 -0600
Joseph <[email protected]> wrote:
On 04/28/14 09:17, Joseph wrote:
>Which program do I upgrade to fix Heartbleed bug?
>
>http://safeweb.norton.com/heartbleed/
>is showing me my server is vulnerable.
>I'm using dev-libs/openssl-0.9.8y
>
>Why "safeweb.norton" is triggering my server vulnerable?
I'm using apache-2.2.25
Which file contain setting for: SSLCompression
I'm trying to turn it off.
Unaffected according to:
http://www.gentoo.org/security/en/glsa/glsa-201404-07.xml
Perhaps all you need to do is restart the Apache service?
--
With kind regards,
Tom Wijsman (TomWij)
Gentoo Developer
E-mail address : [email protected]
GPG Public Key : 6D34E57D
GPG Fingerprint : C165 AF18 AB4C 400B C3D2 ABF0 95B2 1FCD 6D34 E57D
No, I was wrong. I had both version istalled: 0.9.8y and 1.0.1f
and the one that was in use was buggy one: 1.0.1f
I recompile 1.0.1f without tls-heartbeat and the problem is solved.
dev-libs/openssl
Available versions:
(0.9.8) 0.9.8y
(0) 1.0.0j 1.0.1f
{bindist gmp kerberos rfc3779 sse2 static-libs test +tls-heartbeat
vanilla zlib}
Installed versions: 0.9.8y(0.9.8)(11:06:09 PM 10/18/2013)(sse2 zlib -bindist -gmp -kerberos -test) 1.0.1f(12:57:54 PM 03/21/2014)(sse2 tls-heartbeat zlib
-bindist -gmp -kerberos -rfc3779 -static-libs -test -vanilla)
But what puzzle me is when I downgraded it to 1.0.0j (uneffected version) I
could not restart apache. I was getting an error:
/etc/init.d/apache2 restart
* apache2 has detected an error in your setup:
apache2: Syntax error on line 125 of /etc/apache2/httpd.conf: Cannot load /usr/lib64/apache2/modules/mod_ssl.so into server: /usr/lib64/apache2/modules/mod_ssl.so:
undefined symbol: TLSv1_1_client_method
* ERROR: apache2 failed to stop
--
Joseph
