Upgrade OpenSSL

[daithi_dearg]

Hello,

I'm doing a Security scan and there is an OpenSSL Vulnerability and I'm being prompted to upgrade to version 1.0.2k.

I came across the following for another vulnerability:
https://pioneear.wordpress.com/2014/05/01/windows-apache-wamp-or-xampp-openssl-update-to-fix-hearbleed-bug/

This talks about copying these files:
bin\libeay32.dll
bin\ssleay32.dll
bin\openssl.exe

Any suggestions on where I can source these files?

Regards,
David

[gsmith]

It depends on a few factors one of which is what version are you using now.

[daithi_dearg]

I'm currently on 1.0.2j

[daithi_dearg]

I'll also add that it might be worth patching this to 1.1.0 as there is also a Medium Vulnerability against this also.

[Altrea]

Medium Vulnerability in which context?
A local test and development environment can have multiple software security vulnerabilities without ever being attackable or insecure.

If you want to always get best scores in so named vulnerability scanners than xampp is the wrong product for you. XAMPP does not provide single component upgrases.

[daithi_dearg]

We have a tool Nessus that runs and rates vulnerabilities as Critical, High, Medium etc.

Looking at this another way is there a way we can lock down ports so that these can't be scanned?

[Altrea]

Sure, thats what a firewall is for.
Or you can disable ssl if you don't use it
Or you can unplug your network cable,
Or you ask your IT expert what you should do to secure this up.