search

FiloSottile / Heartbleed

A checker (site and tool) for CVE-2014-0160
http://filippo.io/Heartbleed
MIT License
2.31k stars 465 forks source link

SPDY module 'seems' to generate false-positives (but it's NOT!) #43

Open shoenix opened 10 years ago

shoenix commented 10 years ago

After some testing I found out the test tool tests your Apache vulnerable when you have the SPDY module enabled even when you have disabled heartbeats in OpenSSL or are running a correct version of OpenSSL.

bwspath commented 10 years ago

Mod speedy is compiled with --static for most distros. So your shared libs are ok but not used by mod spdy at compile time.. recompile the mod or disable and wait for an update.

Update: on some of our servers disabeling it didn't even make a difference so i would reccomend removing it till either you recompile or get an uptodate version!

shoenix commented 10 years ago

I actually think mod_ssl_with_npn.so (packaged with spdy) is the culprid. Is should be mod_ssl with 1 small extra patch according to the description, but size wise it's 11x bigger so I suspect this is due to static linking. You need to disable this module separately from mod_spdy.

bwspath commented 10 years ago

but we can agree that its not a false positive? its actually using compromised openssl libs be it not in mod spdy then :)

shoenix commented 10 years ago

Yes, it's definitly NOT a false positive! It only 'seems' like it because you think you updated all libraries and restarted. Filippo already added SPDY to the FAQ on his site.

So to be absolutely clear : If you scan Vulnerable with SPDY, you ARE affected and need to disable SPDY, recompile it against a correct openssl version or wait until a proper version is released!

docwhat commented 10 years ago

@FiloSottile or @shoenix

Suggestion: change the title to add " (but are not)" to the end. Just so nobody is confused by scanning the issues.

shoenix commented 10 years ago

Thought the 'seems' implied this, but changed as per request :)

shoenix commented 10 years ago

For what it's worth, I just confirmed: It's mod_ssl_with_npn.so. Just checked out the code, only built the mod_ssl_with_npn.so replaced it and the problem is solved.