Embed Size (px)
DESCRIPTION
Slides from my talk about how the HeartBleed OpenSSL vulnerability affects Apache CloudStack and how to mitigate the vulnerability. From CloudStack Collaboration Conference 2014 in Denver, CO
Citation preview
CloudStack and “HeartBleed”
We’re here to talk about…
What is Vulnerable• Apache CloudStack 4.2 – 4.3• SystemVMs have vulnerable version of OpenSSL installed• In particular, SSVM is running vulnerable services
FRIENDS DON’T LET FRIENDS USE REALHOSTIP
Status• Apache CloudStack has issued patch instructions
• We’re working on updated SystemVM templates
How to patch• ssh to SystemVM• apt-get update• apt-get install openssl libssl1.0.0 • /etc/init.d/apache2 restart
How to verifydpkg -l|grep ssl
ii libssl1.0.0:i386 1.0.1e-2+deb7u6 i386 SSL shared librariesii openssl 1.0.1e-2+deb7u6 i386 Secure Socket Layer (SSL) binary
External tests• http://filippo.io/Heartbleed/
• https://gist.github.com/takeshixx/10107280 - run yourself
HoneypotUsing http://packetstormsecurity.com/files/126068/hb_honeypot.pl.txt
$ sudo perl heartbleed_honeypot.pl
182.118.60.51
182.118.60.51
182.118.60.51
182.118.60.51
Honeypot sniff
Honeypot sniff
Honeypot sniff
ASF Infrastructure team:
“Thank you for your patience while we have worked to sort this out.We expect to reset all LDAP passwords within the next 48 hours or so,so do not be alarmed when your password stops working.”
kthxbye!• http://cloudstack.apache.org
@johnlkinsella
