OpenSSL and Heart Bleed Vuln

What versions of the OpenSSL are affected?

Status of different versions:

OpenSSL 1.0.1 through 1.0.1f (inclusive) are vulnerable
OpenSSL 1.0.1g is NOT vulnerable
OpenSSL 1.0.0 branch is NOT vulnerable
OpenSSL 0.9.8 branch is NOT vulnerable

veriosn 11.3/11.4 uses openssl 0.9.8, run openssl version on cli to confirm

if you want to test you could use

http://filippo.io/Heartbleed/

My 11.5.0 comes back as not vulnerable.

You can check if you are retuning the TLS heartbeat extension using the following from bash:

 openssl s_client -connect google.com:443  -tlsextdebug 2>&1| grep 'server extension "heartbeat" (id=15)' || echo safe 

It with return the extension if affected, otherwise "Safe". If it does return the extension, check your version of OpenSSL ...This should be no-one running an F5 I don't think.

Hi Guys, I have one question, whether the F5s use Openssl for SSL offloading functionality? Or is it just a tool installed on the F5s to use for SSL testing.

Thanks

To the question about offload, it is my understanding that the openssl is used for csr and cert creation but not for the offloading functionality.

According to SOL14457 11.5.0 uses 1.0.1e which is vulnerable http://support.f5.com/kb/en-us/solutions/public/14000/400/sol14457.html

Apparently 1.0.1g or greater addresses the vuln.

I would also like to know (for sure) if OpenSSL is used for offloading, James comment above that his 11.5.0 appears not subject to the vulnerability suggests it's not ... regardless I imagine a patch is needed.

Whether OpenSSL is used or not will depend on the cipher string in your SSL profiles. If you're using the DEFAULT or NATIVE strings or something else that only uses native ciphers then OpenSSL is NOT used and the Cavium offload card (and related proprietary SSL/TLS software) is. If you're using something else (a compat cipher) then OpenSSL is. A cipher string specifying any compat cipher, even if the rest are native, will result in OpenSSL being used. <

Find the definitive list here and modify your profiles accordingly: http://support.f5.com/kb/en-us/solutions/public/13000/100/sol13163.html.

Also remember that you'll get much better performance if you only use native ciphers.

It's important to note that the management console is also vulnerable, making the question of whether your individual hosts are exposed moot for some installations.

Hopefully F5 will give us some good news this morning.