[SOLVED] OpenSSL Heartbleed and my old Slackware 12

czezz · 04-16-2014, 02:40 AM

I read recently about OpenSSL security bug.
I have checked me very old Slackware 12.0.0 installation.

OpenSSL version there is:

Code:

# openssl version
OpenSSL 0.9.8e 23 Feb 2007

According to OpenSSL Security Advisory - TLS heartbeat read overrun (CVE-2014-0160), previous versions (1.0.0 branch and older) are not vulnerable.

Nevertheless I would like to update my OpenSSL to the latest version.
I guess there is no package update for Slackware 12.
So, I was thinking to compile the latest one from sources. Does anyone know any guide how to do that ?

mancha · 04-16-2014, 03:21 AM

Hi.

Upgrading to either the 1.0.0 or 1.0.1 branches will not be pain-free. There will be re-compiling of many other packages
involved so be sure that is what you want. Ask yourself if there's a feature missing in 0.9.8 that is critical for you.

Now, 12.0 is on OpenSSL 0.9.8x (not 0.9.8e) so you seem to not have applied all of 12.0's security updates.

If you decide to stay on 0.9.8, I recommend downloading Slackware 12.0's OpenSSL source files (from patches) and using
them to build 0.9.8y (not 0.9.8x).

--mancha

czezz · 04-16-2014, 04:45 AM

I have just found this Slackware Security Advisories
http://www.slackware.com/security/vi...ecurity.533622
It says that for Slack 14 and 14.1 and -current it can be simply done with upgradepkg

Code:

Upgrade the packages as root:
# upgradepkg openssl-1.0.1g-i486-1_slack14.1.txz openssl-solibs-1.0.1g-i486-1_slack14.1.txz

I guess it will not work with my Slackware 12 at all ?

If so, I have found latest binary/packages openssl-0.9.8x available at http://packages.slackware.com/ ?
Im thinking to do upgradepkg and as 1.0.0 branch and older are not vulnerable I should be quite safe ?

Code:

openssl-0.9.8x-i486-1_slack12.0.tgz
openssl-solibs-0.9.8x-i486-1_slack12.0.tgz

Smokey_justme · 04-16-2014, 05:11 AM

Upgrading to openssl-0.9.8x and openssl-solibs-0.9.8x is pain-free.. Feel free download them from the slackware repositories and use, for example:

Code:

upgradepkg openssl-0.9.8x-i486-1_slack12.0.tgz

to upgrade openssl package

Slackware maintained security updates for 12.0 (I don't think it still does now) version so everything from here: http://mirrors.slackware.com/slackwa...ches/packages/ should be useful for you...

Also, please search for slackpkg (I don't think it's included in slackware 12.0 by default) .. it will help you a lot..

If you want to further upgrade your system, you could consider upgrading step by step to 12.1, 12.2, 13.0, 13.1, 13.37, 14.0, 14.1 .. But I would simply make backups of some setting, dbs and other stuff and do a fresh 14.1 install ..

Please be aware that installing the binaries of openssl-1.0.1g will most likely break your system (not render it unusable, but break it)... You could consider getting the sources from here, modify the slackbuild script and try to see if it compiles (then run upgradepkg on the resulting package), but changes are slim..

hendrickxm · 04-17-2014, 12:32 PM

You could try to compile from source.
Grab all the source and patchfiles from:
http://ftp.slackware.com/pub/slackwa...rce/n/openssl/

You could skip the openssl0 directory. Then go to the directory containing the downloaded files.
If you already had 1.0.1g you had to edit the buildversion but this is not the case for 12.0
Run:

Code:

chmod +x openssl.Slackbuild
upgradepkg /tmp/openssl-...

I cannot test this since I use 14.1.

czezz · 05-06-2014, 09:42 AM

Good point Mancha.
I did like you said. I used openssl.SlackBuild to create package with latest source code for version openssl-0.9.8

Code:

# ls -al /var/log/packages/ | grep -i openssl
-rw-r--r--  1 root root   27951 2014-05-06 16:28 openssl-0.9.8y-i486-1_slack12.0
-rw-r--r--  1 root root    1602 2014-05-06 16:29 openssl-solibs-0.9.8y-i486-1_slack12.0
# openssl version -a
OpenSSL 0.9.8y 5 Feb 2013
built on: Sun May  4 23:25:27 CEST 2014
platform: linux-elf
options:  bn(64,32) md2(int) rc4(idx,int) des(ptr,risc1,16,long) blowfish(idx)
compiler: gcc -fPIC -DOPENSSL_PIC -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -Wa,--noexecstack -DL_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -march=i486 -mtune=i686 -Wall -DOPENSSL_BN_ASM_PART_WORDS -DSHA1_ASM -DMD5_ASM -DRMD160_ASM -DAES_ASM
OPENSSLDIR: "/etc/ssl"

I am going to stay with 0.9.8 version as it is immune for Heartbleed.

@Hendrickxm - actually your link and dir openssl0 contains everything to build 0.9.8y