CVE-2014-0160?

2014-04-11 Thread sbremal
point formats, length=4) ext 00035 (session ticket, length=0) ext 00015 (heartbeat, length=1) -- Your server supports heartbeat. Bug is possible when linking against OpenSSL 1.0.1f or older. Let me check. Actively checking if CVE-2014-0160 works: Server is vulnerable to all attacks tested, please

Re: CVE-2014-0160?

2014-04-11 Thread Mohacsi Janos
00035 (session ticket, length=0) ext 00015 (heartbeat, length=1) -- Your server supports heartbeat. Bug is possible when linking against OpenSSL 1.0.1f or older. Let me check. Actively checking if CVE-2014-0160 works: Server is vulnerable to all attacks tested, please upgrade software ASAP. 4

RE: CVE-2014-0160?

2014-04-11 Thread sbremal
ext 65281 (renegotiation info, length=1) ext 00011 (EC point formats, length=4) ext 00035 (session ticket, length=0) ext 00015 (heartbeat, length=1) -- Your server supports heartbeat. Bug is possible when linking against OpenSSL 1.0.1f or older. Let me check. Actively checking if CVE-2014-0160

RE: CVE-2014-0160?

2014-04-11 Thread Mohacsi Janos
. Let me check. Actively checking if CVE-2014-0160 works: Your server appears to be patched against this bug. Kösz! ;-) Is there any reason why nightly security patches are not enabled by default in FreeBSD? Very easy to configure download and notification if you use freebsd-update: Add

Re: CVE-2014-0160?

2014-04-11 Thread Kimmo Paasiala
or older. Let me check. Actively checking if CVE-2014-0160 works: Your server appears to be patched against this bug. Kösz! ;-) Is there any reason why nightly security patches are not enabled by default in FreeBSD? Cheers B. Why do you make such claim? The security patches

RE: CVE-2014-0160?

2014-04-11 Thread sbremal
I receive daily email from the host which normally shows port audits and vulnerabilities. However, I did not sport anything related to CVE-2014-0160 in this email. I expected the same info comes in this email about the base system as well. How do you normally inform about recent vulnerability

Re: CVE-2014-0160?

2014-04-11 Thread Tom Evans
On Fri, Apr 11, 2014 at 2:26 PM, sbre...@hotmail.com wrote: I receive daily email from the host which normally shows port audits and vulnerabilities. However, I did not sport anything related to CVE-2014-0160 in this email. I expected the same info comes in this email about the base system

RE: CVE-2014-0160?

2014-04-11 Thread Erik Trulsson
Quoting sbre...@hotmail.com: I receive daily email from the host which normally shows port audits and vulnerabilities. However, I did not sport anything related to CVE-2014-0160 in this email. I expected the same info comes in this email about the base system as well. How do you normally

Re: CVE-2014-0160?

2014-04-11 Thread Matthew Seaman
On 11/04/2014 15:34, Erik Trulsson wrote: Quoting sbre...@hotmail.com: I receive daily email from the host which normally shows port audits and vulnerabilities. However, I did not sport anything related to CVE-2014-0160 in this email. I expected the same info comes in this email about

Re: CVE-2014-0160?

2014-04-11 Thread Ryan Steinmetz
On (04/11/14 21:56), Matthew Seaman wrote: http://vuxml.freebsd.org/freebsd/b72bad1c-20ed-11e3-be06-000c29ee3065.html This is applied inconsistently though. While there is an entry for OpenSSL Heartbleed, it doesn't contain any reference to the FreeBSD base system and the security advisories

Re: CVE-2014-0160?

2014-04-11 Thread Ryan Steinmetz
I've also added the affected system information for CVE-2014-0076 and corrected a issue with the affected range values. -r On (04/11/14 17:13), Ryan Steinmetz wrote: On (04/11/14 21:56), Matthew Seaman wrote: http://vuxml.freebsd.org/freebsd/b72bad1c-20ed-11e3-be06-000c29ee3065.html This is