TrustKeeper Scan Engine Update - April 10, 2014

Summary

The latest update to the TrustKeeper Scan Engine is now available. This release was created solely to add detection for the recently disclosed "HeartBleed" vulnerability affecting OpenSSL libraries.

HeartBleed

The HeartBleed vulnerability was disclosed earlier this week, on April 7, 2014 and has been assigned CVE-2014-0160. This vulnerability could affect any service that uses OpenSSL to make secure connections such as: web servers, email services, VPN software and more.

A successful attack would cause an SSL service responding to a TLS heartbeat request to divulge a small amount of the server's memory stack to the attacker. The scope of the attack is limited to loss of confidentiality in private data that can be found in a server's memory stack, however this confidential data may include private keys, passwords or other sensitive information.

This attack works against SSL services that enable TLS heartbeats and run an affected version of OpenSSL. OpenSSL 1.0.1 versions before 1.0.1g are the only affected versions. Version 1.0.1g was released on April 7, 2014 as a security release to address the Heartbleed vulnerability. OpenSSL versions belonging to the 1.0.0 branch or earlier branches are not affected.

How to Detect HeartBleed

All Trustwave customers using the TrustKeeper Scan Engine receive updates automatically as soon as an update is available. Scheduling a scan of your services via the portal will perform a full scan on the targets including a test to detect any services vulnerable to Heartbleed. If a service is identified as vulnerable, a finding similar to that in the image below will appear in the final report.