A new set of bugs have been identified and patched in OpenSSL. The following new bugs have been patched in the latest release of OpenSSL:

• CVE-2010-5298 – possible use of memory after free
• CVE-2014-0195 – buffer overflow via invalid DTLS fragment
• CVE-2014-0198 – possible NULL pointer dereference
• CVE-2014-0221 – DoS from invalid DTLS handshake packet
• CVE-2014-0224 – SSL/TLS MITM vulnerability
• CVE-2014-3470 – client-side DoS when using anonymous ECDH

See the original OpenSSL announcement here.

1. Identifying vulnerable version

• CentOS 5: OpenSSL 0.9.8 versions before openssl-0.9.8e-27 are vulnerable
• CentOS 6: OpenSSL 1.0.1 versions before openssl-1.0.1e-16 are vulnerable

To identify your installed version of OpenSSL, enter the following command:

rpm -qa openssl

2. How to update OpenSSL

To update OpenSSL, issue the following yum command:

yum clean all && yum update "openssl-*" -y

3. Post-update actions

After updating OpenSSL, ensure that all services that use OpenSSL or have OpenSSL files are restarted. To find processes that have old OpenSSL files open, run the following command:

lsof | grep DEL | grep ssl

Examples of processes that may still have the old OpenSSL files open:

• mysql
• postfix
• webmin
• openvpn
• osad
• nrpe

Did you like this?
Tip Curtis K with Bitcoin

Donate via Installed Wallet Copy