Patching/Upgrading OpenSSL
-
A whacking great hole in OpenSSL 1.0.1 was announced today. Can a fixed version be installed on pfSense 2.1 and/or 2.1.1? How is this done?
-
You may be able to fix it by hand, but a better approach would be to roll out 2.1.2 with the fix right now, and encourage updates.
-
pfSense 2.1.1 ships with OpenSSL 0.9.8g which is not vulnerable and neither are earlier versions of pfSense, either.
Edit: pfSense 2.1 and 2.1.1 also ship with OpenSSL 1.0.1 which is vulnerable.
-
pfSense 2.1.1 ships with OpenSSL 0.9.8g which is not vulnerable and neither are earlier versions of pfSense, either.
You have half the story right, but you need the whole story … freebsd ships with 0.9.8g, but pfsense adds 1.0.1e in /usr/local/bin and uses that version for most pfsense needs.
So, yes, I'd say pfsense is vulnerable.
-
My apologies, you are correct. I have confirmed that both pfSense 2.1 and 2.1.1 shipped with a vulnerable version of openssl.
-
pfsense 2.1.1 is vulnerable (webserver for sure, openvpn, ipsec and other crypto might be using libssl also).
-
So 2.0.3 is not vulnerable. The new features that were advertised for that version show openssl 0.9.8y and searches for libssl turn up 'OpenSSL 0.9.8y 5 Feb 2013'. Any chance some packages put their own version of openssl in? I don't use many packages so I don't know.
https://doc.pfsense.org/index.php/2.0.3_New_Features_and_Changes
-
2.1 and 2.1.1 ARE vulnerable.
-
Large number of reputable projects already updated and fixed the issue.
Longer pfSense is without an update, lower reputation it will be… I think, it is unacceptable for such security-centric project not to fix the problem ASAP.
-
Large number of reputable projects already updated and fixed the issue.
Longer pfSense is without an update, lower reputation it will be… I think, it is unacceptable for such security-centric project not to fix the problem ASAP.
You know, this requires a full new release… It's not a matter of compiling/packaging one package and typing one command in a package manager, unlike those other reputable projects.
-
You know, this requires a full new release… It's not a matter of compiling/packaging one package and typing one command in a package manager, unlike those other reputable projects.
Yes, I know. But I haven't heard that it is being worked on yet… And pfsense.org site is still vulnerable, so someone can exploit and put a rogue download mirror... :(
There is also a package to apply custom system patches - may be that can be used in interim to update openssl?
And not having mechanism for quickly applying such security fixes is not really good approach to a security application, you know...
-
Nice rant. However, you should focus that rant at the openssl guys who introduced this brainfart in the first place… Additionally, reading the source code, the entire openssl thing needs a rewrite from scratch.
-
"And pfsense.org site is still vulnerable, so someone can exploit and put a rogue download mirror"
How should that magic happen? To set up a rogue download mirror one doesn't only need to have the certificate and key to let this site seem like the legit pfsense.org domain, but you also had to inject and poison dns queries for all the hosts to actually use your new rogue download mirror. So problem with SSL aside, let's not leap to wild speculations here and throw around FUD.
Greets
-
Nice rant. However, you should focus that rant at the openssl guys who introduced this brainfart in the first place… Additionally, reading the source code, the entire openssl thing needs a rewrite from scratch.
That strategy isn't helpful for fixing the product that we're here to discuss, which is still vulnerable.
I really like pfSense, but the response here is discouraging. This is being treated quite seriously and with high priority almost everywhere else, but here it seems the users are being lectured for even asking about a fix.
-
"And pfsense.org site is still vulnerable, so someone can exploit and put a rogue download mirror"
How should that magic happen? To set up a rogue download mirror one doesn't only need to have the certificate and key to let this site seem like the legit pfsense.org domain, but you also had to inject and poison dns queries for all the hosts to actually use your new rogue download mirror. So problem with SSL aside, let's not leap to wild speculations here and throw around FUD.
Greets
"for all the hosts to actually use your new rogue download mirror"
That doesn't have to be all the hosts, just the one you want to target.
This is, of course, theoretical, however still a real security risk and I would not call this FUD - I know, similar things happen to other sites in the past. -
There is a point to lack of response, as some of us have Gold support subscriptions. Granted, $99 a year is not a lot, but since the community has confirmed both 2.1 and 2.1.1 (the release that I just received a notification about) is vulnerable, you'd think at the very least we'd have a notification urging users not to upgrade to the latest version.
Furthermore, http://filippo.io/Heartbleed/ shows that the portal.pfsense.org site is vulnerable. Not that this is particularly the same as the PfSense platform, but it does have some minor things such as credit card payment information…
To be fair, 66% of the Internet is broken, but you'd expect some kind of announcement on the issue by now. Luckily, I'm a fairly lazy sysadmin and all my PfSense implementations are sitting at 2.0.3 :)
-
Has anyone successfully patched this by hand?
-
No, of course not.@SectorNine50:
Has anyone successfully patched this by hand?
No. Patching by hand would require access to the t0p-s3cr3t pfSense
-tools repo… -
Quote from JimP 1 hour ago:
It's known and we're already working on it.
on RedMine issue https://redmine.pfsense.org/issues/3588
It would be much easier if those managing this took 1 minute to post here so people would know that the fix is being worked on. That would save all this banter in the forum. -
FYI… for those that haven't checked that bug report in the past hour... There is a reply to the redmine bug report as of around an hour ago saying it is already known and being worked on.
