In light of the recently discovered vulnerability known as "Heartbleed," Comodo CA, a leading Certificate Authority and Internet security organization, would like to advise customers to patch OpenSSL to the latest version and would like to confirm that the vulnerability lies with the OpenSSL software and not with Comodo certificates or Comodo CA keys. Comodo will work with customers, partners, platform vendors and service providers to help ensure affected parties are made fully aware of the issue over the coming days, that customer systems are updated with the fixed version of OpenSSL, and that customers can quickly and easily acquire a certificate reissuance that may be required as a result of patching OpenSSL.
What is the 'Heartbleed' vulnerability?
On Tuesday 8th of April 2014, a serious vulnerability to OpenSSL known as 'Heartbleed' was made public by a team of researchers.
The 'Heartbleed' vulnerability means that it is possible for an attacker to silently 'steal' private keys for SSL certificates, as well as other secret information, on affected versions of OpenSSL.
OpenSSL is an incredibly popular cryptographic software library, and provides SSL/TLS communication for large numbers of applications. The bug causing the vulnerability was introduced to OpenSSL in December 2011 and has been 'in the wild' since the release of OpenSSL 1.0.1 on 14th March 2012. However, it was only discovered within the past day and, other than a proof of concept, Comodo is not aware of any real-world exploits at this point in time
Full details of the vulnerability, including more technical details, can be found at: http://heartbleed.com/
What is affected?
OpenSSL versions affected: 1.0.1 through to 1.0.1f (inclusive).
The following OpenSSL versions are NOT affected:
1.0.1g
1.0.0 (entire branch)
0.9.8 (entire branch)
The release of OpenSSL 1.0.1g on the 7th April 2014 fixes the bug.
How do I fix it?
Any systems using vulnerable versions of OpenSSL need to be patched or updated.
OpenSSL themselves have released a patch, and many other software vendors have updated their software as well.
Please contact your vendor for further details.
Patch your server before you install your new certificate. If you put a new certificate onto a vulnerable server you risk compromising the key of the new certificate.
Is my site affected?
Customers can test whether they are affected by visiting https://sslanalyzer.comodoca.com/ to verify the presence of this vulnerability.
What about my certificates?
Because there is a theoretical possibility that Heartbleed could already have been exploited, Comodo must replace certificates on systems running the affected OpenSSL version. Certificates on affected systems should be replaced, as soon as possible and the previous certificates should be revoked.
Comodo have ensured that all of our own websites using OpenSSL have been patched and updated, and we have also reissued certificates for those sites as a precautionary measure.
Comodo, unlike other CAs, has a no-charge reissue policy - so replacing your certificate and maintaining the security of your website and your systems is simple and incurs no additional cost.
To perform a reissue, please follow the normal procedures - reissuing via our web-interface, management portal or the APIs.
Should you need any additional assistance, please contact:
References:
https://www.openssl.org/news/secadv_20140407.txt
More than ever, there is a demand for IT to deliver innovation. Your IBM i has been an essential part of your business operations for years. However, your organization may struggle to maintain the current system and implement new projects. The thousands of customers we've worked with and surveyed state that expectations regarding the digital footprint and vision of the company are not aligned with the current IT environment.
TRY the one package that solves all your document design and printing challenges on all your platforms. Produce bar code labels, electronic forms, ad hoc reports, and RFID tags – without programming! MarkMagic is the only document design and print solution that combines report writing, WYSIWYG label and forms design, and conditional printing in one integrated product. Make sure your data survives when catastrophe hits. Request your trial now! Request Now.
Forms of ransomware has been around for over 30 years, and with more and more organizations suffering attacks each year, it continues to endure. What has made ransomware such a durable threat and what is the best way to combat it? In order to prevent ransomware, organizations must first understand how it works.
Disaster protection is vital to every business. Yet, it often consists of patched together procedures that are prone to error. From automatic backups to data encryption to media management, Robot automates the routine (yet often complex) tasks of iSeries backup and recovery, saving you time and money and making the process safer and more reliable. Automate your backups with the Robot Backup and Recovery Solution. Key features include:
Business users want new applications now. Market and regulatory pressures require faster application updates and delivery into production. Your IBM i developers may be approaching retirement, and you see no sure way to fill their positions with experienced developers. In addition, you may be caught between maintaining your existing applications and the uncertainty of moving to something new.
IT managers hoping to find new IBM i talent are discovering that the pool of experienced RPG programmers and operators or administrators with intimate knowledge of the operating system and the applications that run on it is small. This begs the question: How will you manage the platform that supports such a big part of your business? This guide offers strategies and software suggestions to help you plan IT staffing and resources and smooth the transition after your AS/400 talent retires. Read on to learn:
LATEST COMMENTS
MC Press Online