ROS 6, OpenSSL, and package updates?

Even my NAS is not exposed to the internet so I'd to use a python script to check the status of vulnerability. There are tons of scripts that can help you check the status, and I used this one - https://gist.github.com/anantshri/10238615

But as alanwsg has suggested, 6.1.7 seem to fix the vulnerability. Check the screenshot, redacted some sensitive information
'universe' is hostname of my NAS if anyone is wondering.



Then I'm following the steps by arnomc - http://www.readynas.com/forum/viewtopic.php?f=65&t=75947&start=15#p423049 from STEP 3

I hope this is it.

I also confirm that 6.1.7 updated both my openssl and libssl into 7u6. And the build date was also change for the 8 April 2014.

Sounds like they must have quickly added this fix and hurried 6.1.7 out (they may have even held back 6.1.7 if it was otherwise ready for release earlier to include this fix) to address this serious security issue ASAP.

this is exactly what I had in mind : it's nice to see netgear reacting fast to address this.

Well, knowing the OS6 is also for pro hardware, they should have received many calls concerning this. Adding a packet already made isn't something hard when you build a firmware... That's always better to say once "it's been fixed in the last update" than to say 5 times per consumer "it will be fixed in the last update". That said, I would have liked Netgear to find a way to validate debian packages to get real time updates (or delayed by up to three days for quick testing). I don't have any way to do this without manual testing though (so one man dedicated for the task) so this may not be economically possible.

Since this kept coming up as a question, I thought I'd share the content of an email I received from Netgear this evening.

Basically 4.x and 5.x users have nothing at all to worry about.

NETGEAR has taken steps to prevent compromise of ReadyNAS devices by the Heartbleed bug with the release of new firmware. Please upgrade your ReadyNAS to the latest firmware (6.1.7 or higher), which is available from your ReadyNAS management interface or can be downloaded from the NETGEAR support site (http://kb.netgear.com/app/answers/detail/a_id/20684). Earlier ReadyNAS models (pre-OS 6) use a version of OpenSSL that is not affected by Heartbleed. We recommend the 6.1.7 Firmware Upgrade for the following models: RN102/RN104 Series RN312/RN314/RN316 Series RN516 Series RN716 Series RN2120 RN3220 RN4220 Thank you, The NETGEAR Team

The 5th June there was some newly published criticals vulnerability (http://www.openssl.org/news/secadv_20140605.txt), so I updated my procedure in order to update openssl to "1.0.1e-2+deb7u10_amd64.deb" :
viewtopic.php?f=65&t=75947&p=423049#p423049
"openssl1.0.1e-2+deb7u10" is the newest version (available at that time) there : http://security.debian.org/debian-secur ... o/openssl/
I don't believe it's correcting the last CVE-2014-0224. We'll have to wait.

EDIT: https://security-tracker.debian.org/tra ... -2014-0224
fixed openssl in 1.0.1e-2+deb7u11.