Despite patching efforts, 300K servers are still vulnerable to Heartbleed

[InfoSec News <alerts () infosecnews org>]

http://www.computerworld.com/s/article/9249310/Despite_patching_efforts_300K_servers_are_still_vulnerable_to_Heartbleed

By Lucian Constantin
IDG News Service
June 23, 2014

Despite a great start, the rate of patching OpenSSL servers against the 
critical Heartbleed vulnerability has slowed down to almost a halt. Around 
300,000 servers remain vulnerable and many of them are unlikely to get 
patched anytime soon.

Over the past month only around 9,000 servers were secured, a far cry from 
the almost 300,000 servers patched during the first month after the 
vulnerability was revealed.

The Heartbleed flaw was publicly disclosed in early April and allows 
attackers to extract information from the memory of servers that run 
OpenSSL 1.0.1 through 1.0.1f, if they support an SSL feature called 
"heartbeat." The extracted information can include user passwords and 
long-term server private keys that can be used to decrypt SSL traffic 
captured from servers.

Shortly after the vulnerability was announced, Robert Graham, the CEO of 
Errata Security, ran an Internet scan and found 615,268 publicly 
accessible SSL servers that were vulnerable to Heartbleed. He repeated the 
scan one month later and found that the number of vulnerable systems had 
decreased by almost half, to 318,239.

[...]



--
Evident.io - Continuous Cloud Security for AWS.
Identify and mitigate risks in 5 minutes or less.
Sign up for a free trial @ https://evident.io/