Re: [Unreal-users] SSL Heartbleed security issue & UnrealIRCd

SourceForge Headquarters 1320 Columbia Street Suite 310 San Diego, CA 92101 +1 (858) 422-6466

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Below are some very important additions to previous advisory:

With regards to *NIX:
Some Linux distros (including Debian and Ubuntu) fixed the issue but didn't
update their OpenSSL version. This means they won't show up as the safe
'1.0.0g' version even though they are indeed fixed. So, if you installed the
OpenSSL security update, restarted the IRCd, and still see the old version
in UnrealIRCd then you'll simply have to assume you're safe now.

Regarding the exploit:
The exploit was already out there, it is unknown for how long, but the bug
itself has been in OpenSSL since March 2012. The exploit I found only needed
some minor modifications to work with UnrealIRCd.
When testing the exploit I can indeed see server memory being exposed. This
includes memory of OpenSSL and possibly (likely) some key material. On some
servers I could also see short phrases of text that other users had been
saying. This is all possible without actually getting online as a user on
IRC. And again, this issue exists on any SSL-capable server, not just
UnrealIRCd.

This brings us to a (rather drastic) recommendation:

AFTER YOU HAVE UPGRADED ALL YOUR SERVERS WE RECOMMEND YOU TO GENERATE A NEW
SSL CERTIFICATE & KEYS. I highly recommend this because there's no way to
tell if your private key has been retrieved by someone due to this
vulnerability.
This recommendation is not unique to UnrealIRCd or even IRC, the same
applies to apache, exim, and any other service that was using a vulnerable
OpenSSL. That's why other software makers are actually recommending the same.

HOW TO GENERATE A NEW SSL CERTIFICATE & KEYS
=============================================
If you are using a self-signed certificate, like most people, then see
below. Otherwise, if you are using an SSL certificate that has been signed
by a Certificate Authority then you should already know how to make and get
a new one.

Windows:
Start -> Programs -> UnrealIRCd -> Make Certificate

*NIX:
Run 'make pem' in your Unreal3.2.x directory. After that use 'make install'
if you installed UnrealIRCd in a different directory.

HOW TO ACTUALLY USE THE NEW SSL CERTIFICATE & KEYS
===================================================
Once you have made/installed the new certificate and keys, /OPER up on your
server and run:
/REHASH -ssl
You should see:
*** Notice -- [SSL rehash] XYZ (no...@so...) requested a reload of all
SSL related data (/rehash -ssl)
That's it. You should not see any errors.

There's no need to restart UnrealIRCd (again) if you only want to reload the
certificate and keys. This can be reloaded on the fly with /REHASH -ssl.

Bram Matthys wrote, on 8-4-2014 18:56:
> Hi all,
> 
> A serious issue in OpenSSL was reported yesterday, the so called
> 'Heartbleed' bug (CVE-2014-0160).
> This bug is very serious because it gives remote users the ability to read
> highly sensitive data from memory from programs using OpenSSL. This includes
> private SSL keys, passwords, etc.
> 
> There's a lot of media attention regarding this bug, and a lot of attention
> from hackers. It's likely that there is or very soon will be an active
> exploit available. We therefore suggest to take this matter seriously and
> not delay fixing it (IF you are affected, read on..).
> 
> UNREALIRCD & HEARTBLEED
> ========================
> UnrealIRCd uses the OpenSSL library for all it's SSL/TLS functionality. So
> if you are using an UnrealIRCd version with SSL support then you may be
> vulnerable to this serious security issue.
> 
> Note that even if you are not actively using SSL/TLS, even if you have no
> SSL listen ports, just the simple fact that you COMPILED WITH OpenSSL
> support means you may be affected.
> 
> In fact, even if your server is completely password protected, like a hub.
> Even then, if you are running a vulnerable version of OpenSSL then you are
> still affected.
> 
> HOW TO CHECK IF YOU ARE USING OPENSSL AND WHICH VERSION
> ========================================================
> Windows users who already know they are using the SSL version of UnrealIRCd
> can take a shortcut here: UnrealIRCd 3.2.9-SSL and later on Windows are all
> vulnerable, skip directly to 'I AM VULNERABLE - WHAT TO DO?'.
> 
> Best way to check if you are vulnerable is to execute '/VERSION' as an IRC
> Operator (IRCOp) on your server and verify the OpenSSL version.
> 
> As IRCOp you can also check other servers for OpenSSL on your network by using:
> /VERSION [remote server name]
> 
> This should output the UnrealIRCd version (eg: Unreal3.2.10.2) and some more:
> 
> 1) If you have SSL enabled then you will see something like:
> [17:58:04] -serv.er.name- OpenSSL A.B.Cd [Some Date]
> Continue reading under 'I AM USING SSL - AM I VULNERABLE?'...
> 
> 2) If you are an IRCOp, you did /VERSION, and you did not see any line with
> 'OpenSSL' in it, then this means OpenSSL support is not compiled in and you
> are safe. You don't need to take any action and can stop reading.
> 
> Note that if you are NOT an IRCOp then no OpenSSL version information will
> be displayed. Therefore it's important you execute the /VERSION command as
> IRCOp.
> 
> I AM USING SSL - AM I VULNERABLE?
> ==================================
> The following OpenSSL versions have the security issue:
> * 1.0.1 up to and including 1.0.1f (so: 1.0.1a, 1.0.1b, etc..)
> * 1.0.2-beta1
> 
> The following versions are safe:
> * Any version before 1.0.1, so 1.0.0x or 0.9.8etc...
> * 1.0.1g (which has just been released on April 7, 2014)
> 
> If you are using any such 'safe' version, then you don't need to take any
> action.
> 
> I AM VULNERABLE - WHAT TO DO?
> ==============================
> If you are indeed using 1.0.1-1.0.1f then you are affected by this security
> issue.
> 
> Windows
> --------
> Simply re-download the package from http://www.unrealircd.com/
> The installer will show 'Unreal3.2.10.2-SSL with Heartbeat fix', and once
> installed you will see (by using /VERSION as IRCOp) the OpenSSL version is
> 1.0.1g.
> 
> Linux / *NIX
> -------------
> Update your system the usual way. This depends on your OS and distribution.
> On Debian/Ubuntu it's 'apt-get update; apt-get upgrade', while on
> Redhat-based systems 'yum' is used, etc...
> If you don't have root on your system, consult your (shell) provider.
> 
> You normally don't need to recompile UnrealIRCd. But once you installed an
> updated version of OpenSSL you must RESTART UnrealIRCd. A simple /REHASH is
> not sufficient.
> After UnrealIRCd has been restarted, verify that your OpenSSL version is
> indeed safe now. You can see the OpenSSL version in the boot screen of
> ./unreal start, or check it by running /VERSION as IRCOp as mentioned earlier.
> 
> TIMELINE
> =========
> [2014-04-07 18:39 GMT] OpenSSL Security advisory
> [2014-04-08 15:39 GMT] UnrealIRCd windows download replaced
> [2014-04-08 16:55 GMT] UnrealIRCd advisory e-mail sent out
> 
> UPDATES
> ========
> The following URL contains a copy of this advisory, and any updates to it:
> http://forums.unrealircd.com/viewtopic.php?f=1&t=8265
> 
> 

- -- 
Bram Matthys
Software developer/IT consultant        sy...@vu...
Website:                                  www.vulnscan.org
PGP key:                       www.vulnscan.org/pubkey.asc
PGP fp: EBCA 8977 FCA6 0AB0 6EDB  04A7 6E67 6D45 7FE1 99A6
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.17 (MingW32)

iF4EAREIAAYFAlNE8JkACgkQbmdtRX/hmaaT6QD/YxbkLo/vZ/6Acpxy+MR0vusM
fzXdJHSuQHkkwdIuv2MA/1O8P1GwpvRtNNV4/6Co/+8ZdzXkHmImQYG9dU6G4dLw
=/G8k
-----END PGP SIGNATURE-----