Bug in OpenSSL[SOLVED]

[S3KshuN8]

http://arstechnica.com/security/2014/04/critical-crypto-bug-in-openssl-opens-two-thirds-of-the-web-to-eavesdropping/

How can I tell if my system is at risk or is already compromised? I don't do any online banking or shopping but just the thought of having passwords exposed makes me shudder.

[Xanayoshi]

It doesn't leave logs apparently so no way to know. Either way as far as Ubuntu goes, this base is Ubuntu(UK) so might as well be USA and therefore it is pretty safe to assume you are compromised either way. Not quite so much as OSX or Win, but there is a reason people were appalled to find out their system was on a direct line to Amazon and it wasn't because there were too many choices of quality awesome stuff to purchase.

[S3KshuN8]

So how do I go about updating it? I'm guessing it's not as simple as a "sudo apt-get install" line.

[Xanayoshi]

Pretty Close.

Code: Select all

sudo apt-get update

Code: Select all

sudo apt-get install openssl

2 things...

May have not been applied yet, so version 1.02 is what we are looking for ultimately however, 1.01 will have to do.

I am not sure about the source repository on that particular system, so you could have an issue

You can get the tar directly from them
http://www.openssl.org/source/

and download the beta or the latest

[S3KshuN8]

This is what I get...

s3kshun8@LinuxLaptop:~$ sudo apt-get update
[sudo] password for s3kshun8:
Get:1 http://dl.google.com stable Release.gpg [198 B]
Get:2 http://dl.google.com stable Release [1,347 B]
Hit http://archive.ubuntu.com raring Release.gpg
Hit http://ppa.launchpad.net raring Release.gpg
Get:3 http://dl.google.com stable/main amd64 Packages [1,240 B]
Get:4 http://extras.ubuntu.com raring Release.gpg [72 B]
Get:5 http://dl.google.com stable/main i386 Packages [1,237 B]
Hit http://archive.ubuntu.com raring-updates Release.gpg
Hit http://repo.mate-desktop.org raring Release.gpg
Hit http://ppa.launchpad.net raring Release
Hit http://packages.mate-desktop.org raring Release.gpg
Hit http://mirror1.mate-desktop.org raring Release.gpg
Hit http://extras.ubuntu.com raring Release
Ign http://mirrors.dotsrc.org raring Release.gpg
Hit http://archive.ubuntu.com raring-backports Release.gpg
Hit http://repo.mate-desktop.org raring Release
Hit http://ppa.launchpad.net raring/main Sources
Hit http://packages.mate-desktop.org raring Release
Hit http://mirror1.mate-desktop.org raring Release
Hit http://extras.ubuntu.com raring/main Sources
Ign http://mirrors.dotsrc.org raring Release
Hit http://archive.ubuntu.com raring-security Release.gpg
Ign http://dl.google.com stable/main Translation-en_US
Hit http://repo.mate-desktop.org raring/main amd64 Packages
Hit http://ppa.launchpad.net raring/main amd64 Packages
Ign http://dl.google.com stable/main Translation-en
Hit http://extras.ubuntu.com raring/main amd64 Packages
Hit http://packages.mate-desktop.org raring/main amd64 Packages
Hit http://archive.ubuntu.com raring Release
Hit http://ppa.launchpad.net raring/main i386 Packages
Hit http://repo.mate-desktop.org raring/main i386 Packages
Hit http://extras.ubuntu.com raring/main i386 Packages
Hit http://packages.mate-desktop.org raring/main i386 Packages
Hit http://archive.ubuntu.com raring-updates Release
Hit http://mirror1.mate-desktop.org raring/main amd64 Packages
Hit http://archive.ubuntu.com raring-backports Release
Hit http://mirror1.mate-desktop.org raring/main i386 Packages
Hit http://archive.ubuntu.com raring-security Release
Hit http://archive.ubuntu.com raring/main Sources
Hit http://archive.ubuntu.com raring/restricted Sources
Hit http://archive.ubuntu.com raring/universe Sources
Hit http://archive.ubuntu.com raring/multiverse Sources
Hit http://archive.ubuntu.com raring/main amd64 Packages
Hit http://archive.ubuntu.com raring/restricted amd64 Packages
Hit http://archive.ubuntu.com raring/universe amd64 Packages
Ign http://extras.ubuntu.com raring/main Translation-en_US
Ign http://ppa.launchpad.net raring/main Translation-en_US
Ign http://repo.mate-desktop.org raring/main Translation-en_US
Hit http://archive.ubuntu.com raring/multiverse amd64 Packages
Ign http://extras.ubuntu.com raring/main Translation-en
Ign http://packages.mate-desktop.org raring/main Translation-en_US
Ign http://repo.mate-desktop.org raring/main Translation-en
Ign http://ppa.launchpad.net raring/main Translation-en
Ign http://packages.mate-desktop.org raring/main Translation-en
Hit http://archive.ubuntu.com raring/main i386 Packages
Ign http://mirror1.mate-desktop.org raring/main Translation-en_US
Hit http://archive.ubuntu.com raring/restricted i386 Packages
Ign http://mirror1.mate-desktop.org raring/main Translation-en
Hit http://archive.ubuntu.com raring/universe i386 Packages
Hit http://archive.ubuntu.com raring/multiverse i386 Packages
Hit http://archive.ubuntu.com raring/main Translation-en
Hit http://archive.ubuntu.com raring/multiverse Translation-en
Hit http://archive.ubuntu.com raring/restricted Translation-en
Hit http://archive.ubuntu.com raring/universe Translation-en
Hit http://archive.ubuntu.com raring-updates/main Sources
Hit http://archive.ubuntu.com raring-updates/restricted Sources
Hit http://archive.ubuntu.com raring-updates/universe Sources
Hit http://archive.ubuntu.com raring-updates/multiverse Sources
Hit http://archive.ubuntu.com raring-updates/main amd64 Packages
Hit http://archive.ubuntu.com raring-updates/restricted amd64 Packages
Hit http://archive.ubuntu.com raring-updates/universe amd64 Packages
Hit http://archive.ubuntu.com raring-updates/multiverse amd64 Packages
Hit http://archive.ubuntu.com raring-updates/main i386 Packages
Hit http://archive.ubuntu.com raring-updates/restricted i386 Packages
Hit http://archive.ubuntu.com raring-updates/universe i386 Packages
Err http://mirrors.dotsrc.org raring/apps amd64 Packages
404 Not Found [IP: 130.225.254.116 80]
Hit http://archive.ubuntu.com raring-updates/multiverse i386 Packages
Err http://mirrors.dotsrc.org raring/games amd64 Packages
404 Not Found [IP: 130.225.254.116 80]
Err http://mirrors.dotsrc.org raring/apps i386 Packages
404 Not Found [IP: 130.225.254.116 80]
Hit http://archive.ubuntu.com raring-updates/main Translation-en
Err http://mirrors.dotsrc.org raring/games i386 Packages
404 Not Found [IP: 130.225.254.116 80]
Ign http://mirrors.dotsrc.org raring/apps Translation-en_US
Hit http://archive.ubuntu.com raring-updates/multiverse Translation-en
Ign http://mirrors.dotsrc.org raring/apps Translation-en
Hit http://archive.ubuntu.com raring-updates/restricted Translation-en
Ign http://mirrors.dotsrc.org raring/games Translation-en_US
Hit http://archive.ubuntu.com raring-updates/universe Translation-en
Ign http://mirrors.dotsrc.org raring/games Translation-en
Hit http://archive.ubuntu.com raring-backports/main Sources
Hit http://archive.ubuntu.com raring-backports/restricted Sources
Hit http://archive.ubuntu.com raring-backports/universe Sources
Hit http://archive.ubuntu.com raring-backports/multiverse Sources
Hit http://archive.ubuntu.com raring-backports/main amd64 Packages
Hit http://archive.ubuntu.com raring-backports/restricted amd64 Packages
Hit http://archive.ubuntu.com raring-backports/universe amd64 Packages
Hit http://archive.ubuntu.com raring-backports/multiverse amd64 Packages
Hit http://archive.ubuntu.com raring-backports/main i386 Packages
Hit http://archive.ubuntu.com raring-backports/restricted i386 Packages
Hit http://archive.ubuntu.com raring-backports/universe i386 Packages
Hit http://archive.ubuntu.com raring-backports/multiverse i386 Packages
Hit http://archive.ubuntu.com raring-backports/main Translation-en
Hit http://archive.ubuntu.com raring-backports/multiverse Translation-en
Hit http://archive.ubuntu.com raring-backports/restricted Translation-en
Hit http://archive.ubuntu.com raring-backports/universe Translation-en
Hit http://archive.ubuntu.com raring-security/main Sources
Hit http://archive.ubuntu.com raring-security/restricted Sources
Hit http://archive.ubuntu.com raring-security/universe Sources
Hit http://archive.ubuntu.com raring-security/multiverse Sources
Hit http://archive.ubuntu.com raring-security/main amd64 Packages
Hit http://archive.ubuntu.com raring-security/restricted amd64 Packages
Hit http://archive.ubuntu.com raring-security/universe amd64 Packages
Hit http://archive.ubuntu.com raring-security/multiverse amd64 Packages
Hit http://archive.ubuntu.com raring-security/main i386 Packages
Hit http://archive.ubuntu.com raring-security/restricted i386 Packages
Hit http://archive.ubuntu.com raring-security/universe i386 Packages
Hit http://archive.ubuntu.com raring-security/multiverse i386 Packages
Hit http://archive.ubuntu.com raring-security/main Translation-en
Hit http://archive.ubuntu.com raring-security/multiverse Translation-en
Hit http://archive.ubuntu.com raring-security/restricted Translation-en
Hit http://archive.ubuntu.com raring-security/universe Translation-en
Ign http://archive.ubuntu.com raring/main Translation-en_US
Ign http://archive.ubuntu.com raring/multiverse Translation-en_US
Ign http://archive.ubuntu.com raring/restricted Translation-en_US
Ign http://archive.ubuntu.com raring/universe Translation-en_US
Ign http://archive.ubuntu.com raring-updates/main Translation-en_US
Ign http://archive.ubuntu.com raring-updates/multiverse Translation-en_US
Ign http://archive.ubuntu.com raring-updates/restricted Translation-en_US
Ign http://archive.ubuntu.com raring-updates/universe Translation-en_US
Ign http://archive.ubuntu.com raring-backports/main Translation-en_US
Ign http://archive.ubuntu.com raring-backports/multiverse Translation-en_US
Ign http://archive.ubuntu.com raring-backports/restricted Translation-en_US
Ign http://archive.ubuntu.com raring-backports/universe Translation-en_US
Ign http://archive.ubuntu.com raring-security/main Translation-en_US
Ign http://archive.ubuntu.com raring-security/multiverse Translation-en_US
Ign http://archive.ubuntu.com raring-security/restricted Translation-en_US
Ign http://archive.ubuntu.com raring-security/universe Translation-en_US
Fetched 4,094 B in 22s (183 B/s)
W: Failed to fetch http://mirrors.dotsrc.org/getdeb/ubuntu ... 4/Packages 404 Not Found [IP: 130.225.254.116 80]

W: Failed to fetch http://mirrors.dotsrc.org/getdeb/ubuntu ... 4/Packages 404 Not Found [IP: 130.225.254.116 80]

W: Failed to fetch http://mirrors.dotsrc.org/getdeb/ubuntu ... 6/Packages 404 Not Found [IP: 130.225.254.116 80]

W: Failed to fetch http://mirrors.dotsrc.org/getdeb/ubuntu ... 6/Packages 404 Not Found [IP: 130.225.254.116 80]

E: Some index files failed to download. They have been ignored, or old ones used instead.
s3kshun8@LinuxLaptop:~$ sudo apt-get install openssl
Reading package lists... Done
Building dependency tree
Reading state information... Done
openssl is already the newest version.
0 upgraded, 0 newly installed, 0 to remove and 1 not upgraded.
s3kshun8@LinuxLaptop:~$

I guess I'll just have to wait for the official release to hit the repository and try again...

[S3KshuN8]

I tried downloading the source and following the steps to install it but when I go to command prompt and type:

Code: Select all

openssl

then:

Code: Select all

version

it reports:

OpenSSL 1.0.1c 10 May 2012

The patched version is 1.0.1g from just a few days ago. How long before the patched version is available in the repository? I'd like to be able to just type:

Code: Select all

sudo apt-get update

and

Code: Select all

sudo apt-get install openssl

as was mentioned. The version in the repo really should be updated, this is a pretty big bug.

[BBOSAK2143]

I know is a little off the main subject, but do yourself a favor and dump the getdeb repo! Those things are nightmares, very flighty! They work then they do not! Been there done it a few too many times and not going to ever put those repos in my distros again!

[S3KshuN8]

OK. I would if I knew how...

[BBOSAK2143]

Just gedit sources.list in /etc/apt. See that getdeb stuff keeps changing sites and very very annoying as since it missess those updates when you sudo apt-get update at times will mess with other information that is downloading and will have absolutely nothing to do with pieces you really need! So personally, am doing my best to weed them out and not go with those getdeb sites as are just a pain! Wish most of this software would be available only through a few repos instead of zillions of them! Then again, that might hurt also! Anyway just hope it will help as have found it helped in the past and currently!

[pam]

open terminal and type:

Code: Select all

sudo apt-get install --only-upgrade openssl
sudo apt-get install --only-upgrade libssl1.0.0

to check your version, type:

Code: Select all

dpkg -l | grep "openssl"