topic Re: The heartbleed bug in Operating System - HP-UX

The heartbleed bug

Pomz — Wed, 16 Apr 2014 03:53:08 GMT

Hi Friends,

Anybody know about impact of a recent disclose vunerability ''Heartbleed" bug to HP-UX? and how to prevent it?

Thanks in advanced.

Cheers,

Pomz

Re: The heartbleed bug

Patrick Wallek — Wed, 16 Apr 2014 13:36:28 GMT

I just wrote an internal whitepaper for my company regarding this.

In a nutshell, you need to check the versions of OpenSSL you are running on your system. You can do this in a couple of ways.

# openssl version

Will check the version that is in your $PATH.

You should probably also check and see if you have multiple versions installed on the system.

One way to do this is:

# swlist -l product openssl

It is entirely possible that you have a version from HP installed, that was installed by default with the OS, and also a separate version that was installed from the HP-UX porting and archive centre.

HP's latest version of OpenSSL is available here, but it is based on ver 0.9.8y and 0.9.7m of OpenSSL.

https://h20392.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=OPENSSL11I

The latest OpenSSL from the HP-UX porting and archive centre is here:

http://hpux.connect.org.uk/hppd/hpux/Development/Libraries/openssl-1.0.1g/

Re: The heartbleed bug

Torsten. — Wed, 16 Apr 2014 13:43:22 GMT

HP says, HP-UX is not affected:

http://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c04239413

(unless you installed openssl from another source ...)

Re: The heartbleed bug

Matti_Kurkela — Thu, 17 Apr 2014 12:15:46 GMT

By the way, if you need to explain the Heartbleed bug to a non-technical person, this xkcd.com comic strip can be very helpful:

http://www.xkcd.com/1354/