Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I have installed Ubuntu12.04 on my machine and it got heartBleed version of OpenSSL 1.0.1. So I uninstalled OpenSSL 1.0.1 and install new 1.0.1g version by refering this link.

Now I want to confirm that the "Apache 2.2.22" available on Ubuntu 12.04 is using 1.0.1g and not 1.0.1 version of OpenSSL. How will I confirm this?

share|improve this question

1 Answer 1

up vote 2 down vote accepted
$ apt-cache policy openssl
openssl: Installed: xxx

"Installed: xxx" shows the currently installed version of openssl. Heartbleed is fixed in the following package versions (or later):

Ubuntu 13.10: libssl1.0.0 1.0.1e-3ubuntu1.2

Ubuntu 12.10: libssl1.0.0 1.0.1c-3ubuntu2.7

Ubuntu 12.04 LTS: libssl1.0.0 1.0.1-4ubuntu5.12

If your installed package version is lower than these, then your system is vulnerable to Heartbleed.

share|improve this answer
    
Thanks for the reply. Will this ensure that the Apache I am using (which is available on Ubuntu) is using upgraded OpenSSL1.0.1g? I can see Installed: 1.0.1-4ubuntu5.16 on my machine now. –  Bhushan Kawadkar Jul 31 at 9:51
    
Yes. Make sure you are doing regular security updates - heartbleed is not the only security vulnerability to affect 12.04. –  bain Jul 31 at 9:53
    
Ok great :). What are the other security vulnerability to affect 12.04, Can you share any link or document? Thank you very much :) –  Bhushan Kawadkar Jul 31 at 9:55
    
Here: Ubuntu 12.04 security notices Note that is just the first page, if you scroll down you will see that (as of July 2014) there are 12 pages of vulnerabilities in 12.04. Everyone should do regular security updates. –  bain Jul 31 at 10:04
    
Thanks for the link :) –  Bhushan Kawadkar Jul 31 at 10:05

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.