Apache Friends Support Forum

Hi all, after doing these steps apache will not start
n entry in log event log show apache not working
how can i fix this
thanks Beau
Download the Windows patch files xampp-opensslfix-win32.zip

Stop Apache using the XAMPP control panel

Uncompress the xampp-opensslfix-win32.zip file in your desktop. It contains a folder with the following list of files:
libeay32.dll ssleay32.dll openssl.exe

Navigate to your Apache bin directory, typically under:
c:\xampp\apache\bin

Create a directory to story a copy of the files that will be replaced named 'opensslbackup'

Move the below list of files (located in the c:\xampp\apache\bin directory) to the folder you just created (opensslbackup)
c:\xampp\apache\bin\libeay32.dll c:\xampp\apache\bin\ssleay32.dll c:\xampp\apache\bin\openssl.exe

Copy the files under the xampp-opensslfix-win32 folder you uncompressed in step 3 to c:\xampp\apache\bin

Navigate to your PHP directory, typically under:
c:\xampp\php

Create a directory to story a copy of the files that will be replaced named 'opensslbackup'

Move the below list of files (located in the c:\xampp\php directory) to the folder you just created (opensslbackup)
c:\xampp\php\libeay32.dll c:\xampp\php\ssleay32.dll

Copy the files under the xampp-opensslfix-win32 folder you uncompressed in step 3 to c:\xampp\php

Start Apache using the XAMPP control panel

I have same problem as you

Which version of XAMPP are you running? Note you do not have to patch your Windows version if you are version 1.8.2-x or a previous version. This is only for 1.8.3 versions.

I have 1.8.1 - so only solution is completely reinstal xampp?

i was running 1.83 i have but after manual did install not work i used the new installer Beau

If you are using 1.8.1 on Windows (this is only valid for Windows) you do not need to patch your installation. It uses a previous OpenSSL version that is not affected.

I think your information is not valid - Now, I am reading readme_en.txt in my Xampp directory, and I really have Xampp v 1.8.1 - but in phpinfo() output, there is SSL_VERSION_LIBRARY OpenSSL/1.0.1c. This version of OpenSSL have Hearthbleed bug, I am right?

http://www.openssl.org/news/secadv_20140407.txt

Looks to me like all 1.0.1 versions up to 1.0.1f are affected.

net.work wrote:I think your information is not valid - Now, I am reading readme_en.txt in my Xampp directory, and I really have Xampp v 1.8.1 - but in phpinfo() output, there is SSL_VERSION_LIBRARY OpenSSL/1.0.1c. This version of OpenSSL have Hearthbleed bug, I am right?

Same here. I also did several scans with the different Heartbleed scanners available and all reported that the site is vulnerable.

I have the same issue of Apache not starting after applying the patch.

XAMPP 1.8.3-1 on Windows Server 2012.

It tries to start but never does. No error messages that I could see either - last message in log was from when I shut it down to install the patch.

If I revert the files, Apache starts/works fine.

Is there something I am missing or is this patch maybe only for 1.8.3-3?

I would rather not try to upgrade the whole XAMPP as it makes me nervous to essentially move from one install to another and the system is working nicely at the moment....

Is there a way I can get the patch to work or do I have to do a 1.8.3-4 install/migration to get this fix in?

Thanks.

Not all Heartbleed scans are created equal. Some just look to see if heartbeat is available and call it vulnerable which is not the case. Heartbeat will be available in a patched version or OpenSSL yet not actually vulnerable.

The best test for it out there in my opinion is the one at Qualys. It will tell you quite a bit more than just if you are vulnerable to the Heartbleed bug.

https://www.ssllabs.com/ssltest/index.html