Heartbleed warning - Cyrus admin password leak!
Ken Murchison <[email protected]> Fri, 11 Apr 2014 11:17:01 -0400
| Newsgroups | gmane.mail.imap.cyrus.announce |
|---|---|
| Organization | Carnegie Mellon University |
| Message-ID | <5348076D.9050707__1449.49743194065$1397229485$gmane$org@andrew.cmu.edu> |
This is a multi-part message in MIME format.
--------------060500090809000803040507
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
All,
I'm sure you have all heard about the Heartbleed
<http://heartbleed.com/> bug by now. If not, you definitely need to
read up on it and take appropriate action.
A Cyrus admin (not at CMU) has recently run the check-ssl-heartbleed
<https://github.com/noxxi/p5-scripts/blob/master/check-ssl-heartbleed.pl> script
against his server which was using one of the effected versions of
OpenSSL and was easily able to capture usernames and passwords,
including the admin password.
Again, please check the versions of OpenSSL on your servers and patch or
upgrade them ASAP.
Regards,
Ken
--
Kenneth Murchison
Principal Systems Software Engineer
Carnegie Mellon University
--------------060500090809000803040507
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
</head>
<body bgcolor="#FFFFFF" text="#000000">
All,<br>
<br>
I'm sure you have all heard about the <a
href="http://heartbleed.com/">Heartbleed</a> bug by now. If not,
you definitely need to read up on it and take appropriate action. <br>
<br>
A Cyrus admin (not at CMU) has recently run the <a
href="https://github.com/noxxi/p5-scripts/blob/master/check-ssl-heartbleed.pl">check-ssl-heartbleed</a>
script against his server which was using one of the effected
versions of OpenSSL and was easily able to capture usernames and
passwords, including the admin password.<br>
<br>
Again, please check the versions of OpenSSL on your servers and
patch or upgrade them ASAP.<br>
<br>
Regards,<br>
Ken<br>
<pre class="moz-signature" cols="72">--
Kenneth Murchison
Principal Systems Software Engineer
Carnegie Mellon University
</pre>
</body>
</html>
--------------060500090809000803040507--