OpenSSL CVE-2014-0160

[sthe · Accepted solution]

Hello

Now this is the definitive answer:

Security Bulletin

https://kc.mcafee.com/corporate/index?page=content&id=SB10071

"What to do after upgrading Web Gateway to combat Heartbleed"

https://kc.mcafee.com/corporate/index?page=content&id=KB81669

Well a lot of work to do...

[timode]

Hi,

I'm just wondering if I really have to renew my CA for SSL-Scanning. We use a Sub-CA from our company CA. As far as I know MWG issues certificates for each http-Request for each FQDN (and caches them). So wouldn't it be sufficient to clear the certificate cache to make MWG issue new certificates for each FQDN?

cheers

Timo

[asabban]

Hello,

when you access a website MWG creates a server certificate for that website and signs it with the CA you have configured. To do so MWG needs to load the CA certificate and the private key. This means that information is available in the memory. The memory can be read by an attacker in 64kb chunks, so theoretically it might be possible that someone got access to the private key. That means the CA is compromised and someone who stole it could sign certificates with that CA.

To be secure the best approach would be to have your company CA sign a new Sub-CA , import that into MWG and revoke the old Sub-CA. Because the browsers trust the company CA there shouldn't be a need to distribute a new CA to the clients.

Best,

Andre

[sthe]

Hello Timo

I would not continue to use the SubCA certificate. I am going to revoke it.

Consider this:

Someone was able to steal the private key of the SubCA Cert then it is possible to sign new certificates for whatever purpose. That is the reason why in my opinion it is best to revoke this certificate.

What I have seen on a test system:

After the update is finished it cleans out the old certificates that were issued by the SubCA.

According to release notes a reboot is needed to ensure that no running process continues to use the old OpenSSL libraries, but the update does not indicate that a reboot is needed.

Andre was faster

Message was edited by: sthe / Andre was faster on 4/11/14 2:01:29 PM CEST

[DBO]

Any news about Web Gateway 6.9.x?  Yes I know, it's the next thing to migrate but it is still in place as IronMail 6.7.x.  For Ironmail, the info is just out, 6.7 is ok but nothing on WebWasher 6.9 yet.

[DBO]

Done the test finally and WebWasher 6.9.6 do not have the affected librairie it seem:

[root@___ ~]# rpm -qa openssl

openssl-0.9.7g-cg13

[root@___ ~]# yum list openssl

Loading "installonlyn" plugin

Setting up repositories

cglinux-base                                                         [1/3]

cglinux-base              100% |=========================|  951 B    00:00

cglinux-updates                                                      [2/3]

cglinux-updates           100% |=========================|  951 B    00:00

webwasher-updates                                                    [3/3]

webwasher-updates         100% |=========================|  951 B    00:00

Reading repository metadata in from local files

Installed Packages

openssl.i586                             0.9.7g-cg13            installed

[asabban]

That is correct. Unfortunately the EOLed versions have not been explicitly mentioned in the announcements.

Best,

Andre