0
0
The Heartbleed bug has a lot of people asking how to check the version of an installed package. I'm included since I have not discovered a way.
Unfortunately, backpatching has made version checking nearly useless because the info remains at the downlevel. For example (from Fedora):
$ openssl version -a
OpenSSL 1.0.1e-fips 11 Feb 2013
built on: Tue Apr 8 00:29:11 UTC 2014
platform: linux-x86_64
options: bn(64,64) md2(int) rc4(16x,int) des(idx,cisc,16,int) idea(int) ...
compiler: gcc -fPIC -DOPENSSL_PIC -DZLIB -DOPENSSL_THREADS -D_REENTRANT ...
OPENSSLDIR: "/etc/pki/tls"
engines: dynamic
And Yum and Apt-Get are no better because they do not provide an effective security version (from Fedora with Yum):
$ yum info openssl
Loaded plugins: langpacks, refresh-packagekit
Installed Packages
Name : openssl
Arch : x86_64
Epoch : 1
Version : 1.0.1e
Release : 37.fc19.1
Size : 1.5 M
Repo : installed
From repo : updates
Summary : Utilities from the general purpose cryptography library with TLS
: implementation
URL : http://www.openssl.org/
License : OpenSSL
Description : The OpenSSL toolkit provides support for secure communications
: between machines. OpenSSL includes a certificate management tool
: and shared libraries which provide various cryptographic
: algorithms and protocols.
And (from Ubuntu and Apt-Cache):
$ apt-cache showpkg openssl
Package: openssl
Versions:
1.0.1e-3ubuntu1.2 (/var/lib/apt/lists/us.archive.ubuntu.com_ubuntu_dists_saucy-updates_main_binary-amd64_Packages) (/var/lib/apt/lists/security.ubuntu.com_ubuntu_dists_saucy-security_main_binary-amd64_Packages) (/var/lib/dpkg/status)
Description Language:
File: /var/lib/apt/lists/us.archive.ubuntu.com_ubuntu_dists_saucy_main_binary-amd64_Packages
MD5: 977022bc5545601176b69704acc5df9b
Description Language: en
File: /var/lib/apt/lists/us.archive.ubuntu.com_ubuntu_dists_saucy_main_i18n_Translation-en
MD5: 977022bc5545601176b69704acc5df9b
1.0.1e-3ubuntu1 (/var/lib/apt/lists/us.archive.ubuntu.com_ubuntu_dists_saucy_main_binary-amd64_Packages)
...
Provides:
1.0.1e-3ubuntu1.2 -
1.0.1e-3ubuntu1 -
As can be seen above, there's no information available on the effective security version ("1.0.1g"). The only information provided is that OpenSSL is downlevel ("1.0.1e") and possibly vulnerable to the latest bug.
Backpatching and downlevel version numbers has got to be one of the dumbest security decisions in history. Its right up there with
(1) opportunistic encryption is bad, plain text is good (browsers), and
(2) using public information as a secret/challenge question.
How does one determine the effective security version of a package that has been backpatched when using Yum and Apt-Get? (This is a generalized question, and not particular to OpenSSL).
See the release note https://admin.fedoraproject.org/updates/openssl-1.0.1e-37.fc19.1 linked from https://apps.fedoraproject.org/packages/openssl
– Dan D. – 2014-04-11T05:20:44.880Backpatching and downlevel version numbers has got to be one of the dumbest security decisions in history
- Right, so just go run the unstable branches... Surely you are completely happy with unplanned, arbitrary changes constantly happening at any random point in time. – Zoredache – 2014-04-11T07:32:32.677@Zoredache - I'm talking about security engineering, and you're talking about usability. From a usability standpoint, how is running Nessus {daily|weekly|monthly} to ensure compliance during audits improve usability? The results I have observed is systems often becomes unstable. And why would someone need to go to unstable when packages like OpenSSL, libxml2, etc are stable and binary compatible? – jww – 2014-04-11T12:13:45.637