[prev in list] [next in list] [prev in thread] [next in thread]
List: isn
Subject: [ISN] Despite patching efforts, 300K servers are still vulnerable to Heartbleed
From: InfoSec News <alerts () infosecnews ! org>
Date: 2014-06-24 5:19:42
Message-ID: alpine.DEB.2.02.1406240519310.23451 () infosecnews ! org
[Download RAW message or body]
http://www.computerworld.com/s/article/9249310/Despite_patching_efforts_300K_servers_are_still_vulnerable_to_Heartbleed
By Lucian Constantin
IDG News Service
June 23, 2014
Despite a great start, the rate of patching OpenSSL servers against the
critical Heartbleed vulnerability has slowed down to almost a halt. Around
300,000 servers remain vulnerable and many of them are unlikely to get
patched anytime soon.
Over the past month only around 9,000 servers were secured, a far cry from
the almost 300,000 servers patched during the first month after the
vulnerability was revealed.
The Heartbleed flaw was publicly disclosed in early April and allows
attackers to extract information from the memory of servers that run
OpenSSL 1.0.1 through 1.0.1f, if they support an SSL feature called
"heartbeat." The extracted information can include user passwords and
long-term server private keys that can be used to decrypt SSL traffic
captured from servers.
Shortly after the vulnerability was announced, Robert Graham, the CEO of
Errata Security, ran an Internet scan and found 615,268 publicly
accessible SSL servers that were vulnerable to Heartbleed. He repeated the
scan one month later and found that the number of vulnerable systems had
decreased by almost half, to 318,239.
[...]
--
Evident.io - Continuous Cloud Security for AWS.
Identify and mitigate risks in 5 minutes or less.
Sign up for a free trial @ https://evident.io/
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic