Technical Alert: OpenSSL Heartbleed Vulnerability

A vulnerability in OpenSSL could allow an attacker to expose memory contents from a server, which could result in exposure of sensitive information such as usernames, passwords, session IDs, and secret keys used for encryption.

Exploit code for the OpenSSL “heartbleed” vulnerability has been made publicly available. Any service using a vulnerable version of OpenSSL is very likely susceptible to attack.

Exploit code is publicly available. IIA has confirmed that the exploit code is able to extract server memory contents from vulnerable hosts.

Campus units may submit requests to IIA ([email protected]) for testing of specific systems for the OpenSSL vulnerability. Please include the system’s IP address in your scan request. If your unit has vendor products that use OpenSSL, please check with the vendors to find out if those products are vulnerable.

IIA is continuing to scan campus networks and monitor network activity related to the OpenSSL vulnerability. IIA is contacting affected units when vulnerable services are detected.

System administrators should test systems for the Heartbleed vulnerability and update vulnerable systems. It is possible to mitigate this vulnerability by recompiling vulnerable software with the -DOPENSSL_NO_HEARTBEATS option if upgrading to OpenSSL 1.0.1g is not a preferred solution.

After fixing vulnerable software, units should replace SSL certificates that were in use on vulnerable systems.

IIA recommends that units consider implementing Perfect Forward Secrecy to reduce the amount of harm that can be caused by exposure of private keys.

In December 2011, a missing bounds check was introduced into the implementation of the TLS/DTLS heartbeat functionality in version 1.0.1 of OpenSSL, which was released publicly in March 2012. This can allow a remote attacker to obtain up to 64KB of data from process memory. This attack can be repeated in order to obtain enough memory contents to retrieve the intended secrets. The bug was fixed in version 1.0.1g of OpenSSL, which was released on April 7, 2014.

Please advise users not to do anything immediately. Users should wait a few days to allow sites time to apply patches. After waiting, users should change their passwords for any websites or other services that may have been vulnerable. Let them know that this only affects sites where the URL begins with https. Users can reference http://filippo.io/Heartbleed/ to check whether a particular site is still vulnerable and it is not yet safe to change passwords for that site. Remind users that they should not use their UMICH password with any non-university service.

ITS recommends that users change their UMICH passwords twice a year. Users should be asked to change their UMICH passwords in a few days if they have not done so recently. You can refer them to Choosing and Changing a Secure UMICH Password for instructions. Please mention that they may need to set aside a little time to do this as they may need to update saved passwords for their mobile devices.

Please contact [email protected].

• US-CERT Alert (TA14-098A) OpenSSL ‘Heartbleed’ vulnerability (CVE-2014-0160)
• CVE-2014-0160
• OpenSSL Security Advisory
• The Heartbleed Bug
• Perfect Forward Secrecy
• RFC2409 Section 8 Perfect Forward Secrecy
• ITS: Password Security Checklist
• Choosing and Changing a Secure UMICH Password