CloudStack and the HeartBleed vulnerability
-
Upload
john-kinsella -
Category
Technology
-
view
417 -
download
1
description
Transcript of CloudStack and the HeartBleed vulnerability
CloudStack and “HeartBleed”
We’re here to talk about…
What is Vulnerable• Apache CloudStack 4.2 – 4.3• SystemVMs have vulnerable version of OpenSSL installed• In particular, SSVM is running vulnerable services
FRIENDS DON’T LET FRIENDS USE REALHOSTIP
Status• Apache CloudStack has issued patch instructions
• We’re working on updated SystemVM templates
How to patch• ssh to SystemVM• apt-get update• apt-get install openssl libssl1.0.0 • /etc/init.d/apache2 restart
How to verifydpkg -l|grep ssl
ii libssl1.0.0:i386 1.0.1e-2+deb7u6 i386 SSL shared librariesii openssl 1.0.1e-2+deb7u6 i386 Secure Socket Layer (SSL) binary
External tests• http://filippo.io/Heartbleed/
• https://gist.github.com/takeshixx/10107280 - run yourself
HoneypotUsing http://packetstormsecurity.com/files/126068/hb_honeypot.pl.txt
$ sudo perl heartbleed_honeypot.pl
182.118.60.51
182.118.60.51
182.118.60.51
182.118.60.51
Honeypot sniff
Honeypot sniff
Honeypot sniff
ASF Infrastructure team:
“Thank you for your patience while we have worked to sort this out.We expect to reset all LDAP passwords within the next 48 hours or so,so do not be alarmed when your password stops working.”
kthxbye!• http://cloudstack.apache.org
@johnlkinsella