Moodle OpenSSL 7 Heartbleed

[Wirral_Wonderer]

Has anyone updated their open SSL on Moodle due to the Heartbleed issue - BBC News - Scramble to fix huge 'heartbleed' security bug

 

I am on OpenSSL V 0.9.8x

 

Does anyone know what I need to do to upgrade it to the latest version or am I worrying about nothing?

[localzuk]

Heartbleed Bug says that the 0.9.8 branch isn't vulnerable.

[Wirral_Wonderer]

I searched high and low for it as well!

 

Thanks anyway!

[synaesthesia]

Another site says that it is. I would suggest taking the opportunity to update regardless.

[Wirral_Wonderer]

Ah, any ideas how?

[localzuk]

That depends on the OS you're running.

[Wirral_Wonderer]

It would help if I gave you that info!

 

Windows 2008 using iis

 

Thanks

[localzuk]

Wait, how/why are you using OpenSSL with IIS and not SChannel? Are you running a load balancer or reverse proxy in front of it?

[Wirral_Wonderer]

Er?! Just what I got from php info. To be honest someone else set it up for us.

 

Maybe it's not an issue?

[Wirral_Wonderer]

The LA is providing us with a reverse proxy as well

 

What should we be using?

[tj2419]

We have just installed moodle 2.6 on a windows server and this also says it is running one of the affected versions. Does anyone know how to upgrade OpenSSL on windows?

[unixman_again]

I fixed ours by replacing php_openssl.dll using the info at PHP For Windows:

[tj2419]

I fixed ours by replacing php_openssl.dll using the info at PHP For Windows:

 

Hi Thanks for the link. I may be being a bit slow to catch up but is there supposed to be a file called php_openssl.dll in the download on that link? As i can't find one just have the three folders bin, lib, include and a openssl.cnf file.

 

Do i need to copy all these over? As i also can't seem to find a lib directory to replace on my moodle server.

 

Can you tell i don't play around with php much

[unixman_again]

Depends on your server. If you are running Apache :

• download php-5.4.16-Win32-VC9-x86.zip
  
• move your PHP out of the way
  
• extract the download to where PHP lives
  
• copy your php.ini over
  
• download httpd-2.4.9-win32-VC9.zip from https://www.apachelounge.com/download/additional/
  
• move Apache out of the way
  
• extract the apache download to where apache lives
  
• copy the apache conf over
  
• check apache runs using cmd
  
• if OK, restart apache
  

If you are running IIS, I guess the same applies but ignore the apache stuff.

 

Why upgrade Apache & PHP? Apache is built with OpenSSL and you need to have both patched.