NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
ROS 6, OpenSSL, and package updates?
No sooner do I read this evening that Fedora and others a re quickly working to get OpenSSL 1.0.1e out to fix the latest TLS bug that I log into my 516 to see what version it's running. Oh my, 1.0.1e. When did that happen? Are there magic upgrade faeries on the NAS? :D
47 Replies
Replies have been turned off for this discussion
# dpkg -l | grep libssl
ii libssl1.0.0:amd64 1.0.1e-2+deb7u3 amd64 SSL shared libraries- Guess I need libssl1.0.0_1.0.1e-2+deb7u6_amd64.deb too.
- I did this:
wget http://security.debian.org/debian-security/pool/updates/main/o/openssl/libssl1.0.0_1.0.1e-2+deb7u6_amd64.deb
dpkg -i libssl1.0.0_1.0.1e-2+deb7u6_amd64.deb
service apache2 restart
service ssh restart
That fixed it. - I have the same problem as yours : the test page http://filippo.io/Heartbleed/ give me 1 third of green ok and 2/3 of red still vulnerable. After reading the FAQ, I think I am still vulnerable :/
arnomc wrote: I have the same problem as yours : the test page http://filippo.io/Heartbleed/ give me 1 third of green ok and 2/3 of red still vulnerable. After reading the FAQ, I think I am still vulnerable :/
Right. The directions that you posted earlier are incomplete: Both the openssl package and the libssl1.0.0 package must be updated.- Thanks for your input fastfwd, I already corrected my post.
- I'd like to temperate a bit. Yes you NAS are vulnerable unless fully patched (in security, the overall security level is the one of the weakest link).
That said I don't see anyone wanting to put some effort hacking a single NAS in an unknown network. If you use them in enterprise, they don't have access to internet, so danger comes only from insiders (yep I know most of critical attacks on an information system come from inside).
On top of that I read this : http://www.theverge.com/2014/4/11/56043 ... -after-all
So if you want to patch, do it, that's always a good idea to be fully patched. Otherwise I think you'll need to wait a month at least to get official patch unless it's been silently released under 6.1.7 security fix section. (6.1.7 has gone final today, so no RC6 to fix it and I don't think 6.2.0 will be released in april, I may be wrong though). xeltros wrote: I'd like to temperate a bit. Yes you NAS are vulnerable unless fully patched (in security, the overall security level is the one of the weakest link).
That said I don't see anyone wanting to put some effort hacking a single NAS in an unknown network. If you use them in enterprise, they don't have access to internet, so danger comes only from insiders (yep I know most of critical attacks on an information system come from inside).
On top of that I read this : http://www.theverge.com/2014/4/11/56043 ... -after-all
So if you want to patch, do it, that's always a good idea to be fully patched. Otherwise I think you'll need to wait a month at least to get official patch unless it's been silently released under 6.1.7 security fix section. (6.1.7 has gone final today, so no RC6 to fix it and I don't think 6.2.0 will be released in april, I may be wrong though).
Did the 6.1.7 update before and I think its patched (I did not upgrade the packages myself so must have been the firmware).
root@e1:~# dpkg -l | grep ssl
ii libssl1.0.0:armel 1.0.1e-2+deb7u6 armel SSL shared libraries
ii openssl 1.0.1e-2+deb7u6 armel Secure Socket Layer (SSL) binary and related cryptographic tools
root@e1:~# openssl version -b
built on: Tue Apr 8 10:12:55 UTC 2014- Checked one minute ago (I always check backups before upgrading firmware), same result here, aptitude doesn't have any updated version either. So yes may be fixed (silently like suggested in my post). I can't take heart bleed test since my NAS isn't internet accessible so the tester will have a firewall drop packet and will say I'm good to go no matter the openssl version I have ;)
- Just updated my RN102 to OS6.1.7 and can confirm it's fixed.
Using http://filippo.io/Heartbleed/ it showed it vulnerable at 6.1.6, secure at 6.1.7
NETGEAR Academy
Boost your skills with the Netgear Academy - Get trained, certified and stay ahead with the latest Netgear technology!
Join Us!
