oss-sec mailing list archives
Re: Cauterizing OpenSSL's heartbleed (the aftermath)
From: Seth Arnold <seth.arnold () canonical com>
Date: Wed, 9 Apr 2014 16:20:14 -0700
On Wed, Apr 09, 2014 at 10:47:48PM +0000, mancha wrote:
Mustafa Al-Bassam's work assists a great deal with this taxonomy. He ran PoC code against Alexa top 100, 1000, and 10000 sites beginning about 18 hours after OpenSSL's first public announcement [1]. Specifically, his scans began circa: 1396956600 (top 100); 1396958400 (top 1000); and 1396972800 (top 10000). Did any major vendors deploy upgrades prior to this?
Ubuntu's updates were released around 1396907296 [2], roughly 13 hours before Mustafa's awesome scans. Thanks
[1] https://github.com/musalbas/heartbleed-masstest
[2] https://launchpad.net/ubuntu/+source/openssl/+publishinghistory The 'security' column of the publishing history is when packages were made available on security.ubuntu.com. (To take load off our security servers, the security updates are copied into 'updates', and from there propogated to our mirror network.)
Attachment:
signature.asc
Description: Digital signature
Current thread:
- Cauterizing OpenSSL's heartbleed (the aftermath) mancha (Apr 09)
- Re: Cauterizing OpenSSL's heartbleed (the aftermath) Seth Arnold (Apr 09)
- Re: Cauterizing OpenSSL's heartbleed (the aftermath) Yves-Alexis Perez (Apr 09)
- Re: Cauterizing OpenSSL's heartbleed (the aftermath) mancha (Apr 11)
- Re: Cauterizing OpenSSL's heartbleed (the aftermath) Seth Arnold (Apr 09)