You are viewing a plain text version of this content. The canonical link for it is here.
Posted to modperl@perl.apache.org by Josh Chamas <jo...@chamas.com> on 2002/09/17 21:42:44 UTC
Linux + Apache Worm exploiting pre 0.9.6g OpenSSL vulnerabilities
on the loose
Hey,
There seems to be a worm spreading for Apache + Linux + OpenSSL
servers that I saw a discussion on at
http://apache.slashdot.org/apache/02/09/13/2315246.shtml?tid=172
Seems like we need to upgrade our apache servers to OpenSSL 0.9.6g
if we haven't already. I didn't see this posted to mod_perl
yet, forgive me if this has been sent out already.
Based on discussion at:
http://online.securityfocus.com/bid/5363/discussion/
it seems that we might need to upgrade modssl as well,
but I have not seen a release of modssl since June
( see http://www.modssl.org/news/ ), so this seems to
not be necessary, but do not take my word for it, upgrade
if you think its a good idea ( probably is anyway ).
Regards,
Josh
________________________________________________________________
Josh Chamas, Founder phone:925-552-0128
Chamas Enterprises Inc. http://www.chamas.com
NodeWorks Link Checking http://www.nodeworks.com
RE: Linux + Apache Worm exploiting pre 0.9.6g OpenSSL vulnerabilities on the loose
Posted by Rob Nagler <na...@bivio.biz>.
Christian Gilmore writes:
> I believe the virus only affects systems pre-0.9.6e:
> http://www.openssl.org/news/secadv_20020730.
Also note that vendors may have retrofited older versions with the
patch. For example, Red Hat still is at 0.9.5a & 0.9.6b
(see http://rhn.redhat.com/errata/RHSA-2002-160.html for more info)
Rob
RE: Linux + Apache Worm exploiting pre 0.9.6g OpenSSL vulnerabilities on the loose
Posted by Rob Nagler <na...@bivio.biz>.
Christian Gilmore writes:
> I believe the virus only affects systems pre-0.9.6e:
> http://www.openssl.org/news/secadv_20020730.
Also note that vendors may have retrofited older versions with the
patch. For example, Red Hat still is at 0.9.5a & 0.9.6b
(see http://rhn.redhat.com/errata/RHSA-2002-160.html for more info)
Rob
---------------------------------------------------------------------
To unsubscribe, e-mail: asp-unsubscribe@perl.apache.org
For additional commands, e-mail: asp-help@perl.apache.org
RE: Linux + Apache Worm exploiting pre 0.9.6g OpenSSL vulnerabilities on the loose
Posted by Christian Gilmore <cg...@tivoli.com>.
Josh,
I believe the virus only affects systems pre-0.9.6e:
http://www.openssl.org/news/secadv_20020730.txt.
Thanks,
Christian
-----------------
Christian Gilmore
Technology Leader
GeT WW Global Applications Development
IBM Software Group
> -----Original Message-----
> From: Josh Chamas [mailto:josh@chamas.com]
> Sent: Tuesday, September 17, 2002 2:43 PM
> To: modperl@perl.apache.org; asp@perl.apache.org
> Subject: Linux + Apache Worm exploiting pre 0.9.6g OpenSSL
> vulnerabilities on the loose
>
>
> Hey,
>
> There seems to be a worm spreading for Apache + Linux + OpenSSL
> servers that I saw a discussion on at
>
> http://apache.slashdot.org/apache/02/09/13/2315246.shtml?tid=172
>
> Seems like we need to upgrade our apache servers to OpenSSL 0.9.6g
> if we haven't already. I didn't see this posted to mod_perl
> yet, forgive me if this has been sent out already.
>
> Based on discussion at:
>
> http://online.securityfocus.com/bid/5363/discussion/
>
> it seems that we might need to upgrade modssl as well,
> but I have not seen a release of modssl since June
> ( see http://www.modssl.org/news/ ), so this seems to
> not be necessary, but do not take my word for it, upgrade
> if you think its a good idea ( probably is anyway ).
>
> Regards,
>
> Josh
> ________________________________________________________________
> Josh Chamas, Founder phone:925-552-0128
> Chamas Enterprises Inc. http://www.chamas.com
> NodeWorks Link Checking http://www.nodeworks.com
>