# MA-383.042014: MyCERT Advisory - Step-By-Step Guide to Fix OpenSSL Heartbleed Information Disclosure Vulnerability

**Date:** 10 Apr 2014  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-383.042014  
**Advisory ID:** MA-383.042014

---

**1.0 Introduction**
Recently MyCERT had released an Alert regarding a high level vulnerability that exist on OpenSSL Versions 1.0.1 through 1.0.1f that could disclose sensitive information belonging to users to an attacker.
The vulnerability allows anyone on the Internet to read the 64K memory of the systems protected by the vulnerable versions of the OpenSSL software. There is a possibility that this may compromise the secret keys used to identify the service providers and to encrypt the traffic, the names and passwords of the users and the actual content. This allows attackers to eavesdrop communications, steal data directly from the services and users to impersonate services and users.
There are many applications that use SSL for example Web, Email, VPN. For this reason, MyCERT had produced this Advisory to provide a general Step-By-Step guide on rectifying the issue.
**2.0 Impact**
The impact of this vulnerability is a remote, unauthenticated attacker may be able to retrieve sensitive information, such as secret keys. By using the sensitive information, an attacker may be able to access to the system, decrypt, spoof, or perform man-in-the-middle attacks on network traffic that would otherwise be protected by OpenSSL.
**3.0 Systems Affected**
At present we know that the following servers are vulnerable and patches are available for them:
- Debian Wheezy (stable), OpenSSL 1.0.1e-2+deb7u4
- Ubuntu 12.04.4 LTS, OpenSSL 1.0.1-4ubuntu5.11
- CentOS 6.5, OpenSSL 1.0.1e-15
- OpenBSD 5.3 (OpenSSL 1.0.1c 10 May 2012) and 5.4 (OpenSSL 1.0.1c 10 May 2012)
- FreeBSD 10.0 - OpenSSL 1.0.1e 11 Feb 2013
- NetBSD 5.0.2 (OpenSSL 1.0.1e)
- OpenSUSE 12.2 (OpenSSL 1.0.1c)
But it is likely there are other operating systems and appliances which are also vulnerable for which the vendors are yet to release patches.
**4.0 Recommendation to Fix the Vulnerability**
4.1 Check and verify if your website is affected by this vulnerability. You may refer to the below tools:
- LastPass Heartbleed Checker
<https://lastpass.com/heartbleed/>
- MyCERT Tool
<http://heartbleed.honeynet.org.my>
4.2 If your website is confirmed to be affected by this vulnerability, you may refer to the below recommendations:
> 4.2.1 For System Administrators:
>
> A) Update your OpenSSL Library to OpenSSL 1.0.1g
>
> This vulnerability issue is addressed in OpenSSL 1.0.1g. User may contact their respective software vendor to check for availability of updates.
>
> Or:
>
> Another recommendation is to recompile OpenSSL with the -DOPENSSL\_NO\_HEARTBEATS flag. Software that uses OpenSSL, such as Apache or Nginx would need to be restarted for the chanages to take effect. End users may contact their respective software vendor to recompile the OpenSSL.
>
> B) Revoke your old private keys.
>
> C) Generate new private keys
>
> D) Create certificates for new private keys
>
> E) Restart the service (many also forgetting this leaving the old secrets or version loaded)
>
> F) Validate you are no longer vulnerable with the numerous test scripts available.
>
> G) Check all your servers and services, not just the most obvious candidates. Backup servers, hot stand by and others may still be vulnerable.
>
> H) Check for any evidence of malpractice (though unlikely available) and instigate incident response procedures and customer notification as required. Perform a risk assessment too to identify any tokens or sensitive data that may have been lost which provide attackers with alternative channels.
>
> I) Besides external websites, System Administrators must consider to check products from security vendors to customer databases whether they are vulnerable. Some of these systems could provide attackers with the ability to escalate and further attack within your network.
>
> J) Vendors may consider to implement detection routines that look for those trying to use the attack. This is helpful to identify systems you may have missed and may enable you to react quickly in the event of further problems.
>
> 4.2.2 For End Users:
>
> A) We advise users to be extra precautious when accessing websites using SSL especially those that requires username/passwords. Users can check and verify if the website is affected by this vulnerability at:
>
> - <https://lastpass.com/heartbleed/>
> - <http://heartbleed.honeynet.org.my>
>
> OR
>
> Users may refer direct to the Banks or Merchants for verification if their website is vulnerable.
>
> B) Recommended user to change their sensitive information such as their passwords of sensitive account immediately after receive confirmation of a security patches.
>
> C) Monitor your online financial statement regularly.
>
> D) Be precautious of suspicious emails that pretends to offers fix to the vulnerability.Do not respond or click on any links or attachments in the the emails as they may contain malicious codes that lead to unwanted incidents.
MyCERT generally advise users of this product to keep themselves updated with the latest security announcements by the vendor. If users have any enquiries on this matter, please reach us through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection#95f6ecf7f0e7acacacd5f6ecf7f0e7e6f0f6e0e7fce1ecbbf8ec)
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442
Handphone : +60 19 2665850 (24x7 on call incident reporting)
SMS : CYBER999 REPORT to 15888
Business Hours : Mon - Fri 09:00 -18:00 MYT
Web: <https://www.mycert.org.my>
**5.0 Reference**
- <http://heartbleed.com/>
- <http://www.kb.cert.org/vuls/id/720951>
- <https://www.openssl.org/news/secadv_20140407.txt>
- <https://www.mycert.org.my/portal/advisory?id=MA-382.042014>
- <https://community.openvpn.net/openvpn/wiki/heartbleed>
- <https://cs.auscert.org.au/news/openssl-vulnerability-widespread>
- <http://www.forbes.com/sites/jameslyne/2014/04/10/avoiding-heartbleed-hype-what-to-do-to-stay-safe/>