All system admins if your vicidial is exposed to the web and has https:// runing your system can be compromised. A new bug in openssl allows reading of your mysql user and password. We were able to exploit our own servers in about 5 minutes with this bug. We were able to get the vicidail database user and password for mysql as well as usernames and passwords of managers logged into vicidial.
vicibox by default has https enabled so this effects you whether your using it or not.
to check and see if your effected run:
- Code: Select all
openssl version
if you get:
OpenSSL 1.0.1e 11 Feb 2013
Your server is vulnerable.
The bug exists in openssl 101e opensuse has not patched it as of now. 04/08/2014 12:30 pm PST..
You can either disable https or compile openssl.. We chose to compile it...
Compile at your own risk.. However its a bigger risk IMHO to sit on your hands and wait for a patch.
Log out all agents before doing this..
- Code: Select all
zypper si openssl
cd /usr/src
wget http://www.openssl.org/source/openssl-1.0.1g.tar.gz
tar xvzf openssl-1.0.1g.tar.gz
cd openssl-1.0.1g/
./config --prefix=/usr/
make
make install
reboot
