<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><a name="_MailEndCompose"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></a></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Ryan Ware [mailto:ryan.r.ware@intel.com]
<br>
<b>Sent:</b> Tuesday, April 08, 2014 7:11 AM<br>
<b>To:</b> OTC ALL<br>
<b>Subject:</b> OpenSSL Heartblead (CVE-2014-0160)<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">I wanted to take a moment and make sure everyone knows about this critical security vulnerability. While system administrators in OTC (and outside) already know about this, I also know that people have many side projects and personal infrastructure
as well.<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">The comment with the OpenSSL patch that fixes this issue can be found here (<a href="https://www.openssl.org/news/secadv_20140407.txt">https://www.openssl.org/news/secadv_20140407.txt</a>) but since it's short I'll reproduce it as well:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<blockquote style="margin-left:30.0pt;margin-right:0in">
<div>
<pre style="word-wrap:break-word;white-space:pre-wrap"><span style="color:black">OpenSSL Security Advisory [07 Apr 2014]<o:p></o:p></span></pre>
<pre><span style="color:black">========================================<o:p></o:p></span></pre>
<pre><span style="color:black"><o:p> </o:p></span></pre>
<pre><span style="color:black">TLS heartbeat read overrun (CVE-2014-0160)<o:p></o:p></span></pre>
<pre><span style="color:black">==========================================<o:p></o:p></span></pre>
<pre><span style="color:black"><o:p> </o:p></span></pre>
<pre><span style="color:black">A missing bounds check in the handling of the TLS heartbeat extension can be<o:p></o:p></span></pre>
<pre><span style="color:black">used to reveal up to 64k of memory to a connected client or server.<o:p></o:p></span></pre>
<pre><span style="color:black"><o:p> </o:p></span></pre>
<pre><span style="color:black">Only 1.0.1 and 1.0.2-beta releases of OpenSSL are affected including<o:p></o:p></span></pre>
<pre><span style="color:black">1.0.1f and 1.0.2-beta1.<o:p></o:p></span></pre>
<pre><span style="color:black"><o:p> </o:p></span></pre>
<pre><span style="color:black">Thanks for Neel Mehta of Google Security for discovering this bug and to<o:p></o:p></span></pre>
<pre><span style="color:black">Adam Langley <<a href="mailto:agl@chromium.org">agl@chromium.org</a>> and Bodo Moeller <<a href="mailto:bmoeller@acm.org">bmoeller@acm.org</a>> for<o:p></o:p></span></pre>
<pre><span style="color:black">preparing the fix.<o:p></o:p></span></pre>
<pre><span style="color:black"><o:p> </o:p></span></pre>
<pre><span style="color:black">Affected users should upgrade to OpenSSL 1.0.1g. Users unable to immediately<o:p></o:p></span></pre>
<pre><span style="color:black">upgrade can alternatively recompile OpenSSL with -DOPENSSL_NO_HEARTBEATS.<o:p></o:p></span></pre>
<pre><span style="color:black"><o:p> </o:p></span></pre>
<pre><span style="color:black">1.0.2 will be fixed in 1.0.2-beta2.<o:p></o:p></span></pre>
</div>
</blockquote>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Note that it is remotely exploitable and you will not find anything in your logs indicating you were attacked. If you were previously attacked, it is very possible that private keys, passwords or anything else in the server process' memory
space could have been leaked so you probably have more remediation to do (generate new keys, passwords, etc.) than just patch.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">There is a decent article here (<a href="http://arstechnica.com/security/2014/04/critical-crypto-bug-in-openssl-opens-two-thirds-of-the-web-to-eavesdropping/">http://arstechnica.com/security/2014/04/critical-crypto-bug-in-openssl-opens-two-thirds-of-the-web-to-eavesdropping/</a>)
with more info. There is also known exploit code in the wild such as here (<a href="http://s3.jspenguin.org/ssltest.py" target="_blank"><span style="font-size:10.0pt;font-family:"Arial","sans-serif"">http://s3.jspenguin.org/ssltest.py</span></a>). There
is also more information here (<a href="http://heartbleed.com/">http://heartbleed.com/</a>).<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Please take this vulnerability seriously. This is the most significant CVE I've seen in a long time.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Ryan<o:p></o:p></p>
</div>
</div>
</div>
</body>
</html>