openSSL Heartbleed Bug: openVPN affected??

lemussky

Hello all!

I just read about the "openSSL Heartbleed Bug".

What is about openVPN Client/Server versions?
Are they affected?

See:

https://www.openssl.org/news/secadv_20140407.txt

Thanks..

netware5

Yes, generally it is affected. It depends on the OPENSSL version used. On linux the openssl is a separate package, so you can update it with the new fix posted on the official openssl web site. But the OpenVPN Windows client is bundled with the openssl library, so you should either wait for official OpenVPN update or try to update the openssl library only.

You may check the version of the openssl by typing on Linux or Windows command prompt "openssl version". Any version starting with 1.0.1 and greater is vulnerable except the fixed one issued yesterday - 1.0.1g.

I would appreciate any information when updated Windows client bundle will be issued.

netware5

debbie10t wrote.................
Unless you can compile the openvpn source with openssl v101g this problem will remain, upgrading openssl will have no effect on openvpn.

Thank you very much for your explanation. So that raises the question which openssl version is linked within the openvpn binary 2.3.2? And if it is 1.0.1 or above - when we should expect the security fix?

lemussky

Ok, I worry about this.

I've updated all our servers already.
But the windows clients remain a real problem... 🙁

Hope there are official updates available as soon as possible.

netware5

debbie10t wrote
netware5 wrotethat raises the question which openssl version is linked within the openvpn binary 2.3.2?
Openssl 101e ...

So that mean definitely OpenVpn 2.3.2 is vulnerable.

un730235

How do I upgrade OpenSSL to 1.0.1g on a windows server? Can anyone link to a guide?

I have stoppped my OpenVPN service until I get this fixed.

technerd

Great that there's a patch out.. what about OpenVPN on DD-WRT?
How would one patch this? Wait until an entire new firmware is released?

Does this essentially render router-based VPN worthless / hackable?