Hi,
I installed OpenSSL(1.0.1e)last year when I had to create certificates for usage of Plex on my 3rd gen Apple TV. I'm curious as to any potential vulnerability and if I need to install the updated OpenSSL and then generate a new certificate for the Apple TV?
I don't use any of the Plex features to stream over the web so the computers and device in question are isolated on my home network. I'd greatly appreciate any recommendations or suggestions :) Thanks.
Hi,
I installed OpenSSL(1.0.1e)last year when I had to create certificates for usage of Plex on my 3rd gen Apple TV. I'm curious as to any potential vulnerability and if I need to install the updated OpenSSL and then generate a new certificate for the Apple TV?
I don't use any of the Plex features to stream over the web so the computers and device in question are isolated on my home network. I'd greatly appreciate any recommendations or suggestions :) Thanks.
Is this the information you are after: https://www.openssl.org/news/secadv_20140407.txt or do you know this already?
Is this the information you are after: https://www.openssl.org/news/secadv_20140407.txt or do you know this already?
I'm aware that 1.0.1 is vulnerable to the 'heartbleed' exploit but I guess what I am not clear on is... (please forgive me for the meandering reply, I'm kinda working thru my laymens understanding of what I 'think' is going on) :)
-I followed the directions at https://langui.sh/2013/08/27/appletv-ssl-plexconnect/ and all I used openSSL for was to generate a certificate that I then put on the AppleTV. This is to trick the AppleTV to accept things from the plex server on my computer, since it only accepts HTTPS since an update sometime last year.
-Does having OpenSSL installed on a home PC (windows 7 / 64bit) which sits behind a firewall, make it vulnerable to a request sent to my IP address? or does it make my Apple TV vulnerable? I guess I'm unclear as to whether I need to download an updated version of OpenSSL and generate a new certificate for the appleTV. Should I uninstall OpenSSL after creating the certificate? Or will that make it so my appleTV won't be willing to communite with the computer?
-(edit) I just wanted to add that the computers OpenSSL is installed on are also used to browse the web, play games, filesharing, etc. so they aren't completely isolated on the home network and exclusively used to play movies.
Creating a new certificate is a pain but it isn't a problem for me here, what I'm dreading far more is trying to walk my Aunt through doing it over the phone... lol. She's approximately 4 hours away by car round trip and I have a feeling it'll take just as long regardless of which way I do it ;)
Only when a webserver (or another application that serves information) uses the openssl binaries themselves to secure the communication channel, are you vulnerable to teh heartbleed bug. Just having the binaries or a certificate generated by openssl on your system doesn't make you vulnerable as long as there is no application that uses these binaries to actually setup communication.
Thus, when you generate certificates using openssl to be used in another server product (say Microsoft IIS) you're not vulnerable to this bug, since Microsoft uses its own implementation (SChannel) for the security.
Just having the binaries sitting on your machine will not make you vulnerable. Only when a server or client application actually uses them to communicate wil you be in trouble. Normally these applications ship with their own set of the binaries on the windows platform, so while I cannot give you a 100% guarantee here, I'd say that you're safe.
If you want to be sure, you can uninstall openssl from your system, I'd not expect anything on your system to break when you do so.
Looking at the tutorial you walked through, again there is nothing that leads me to believe that you've done anything that will open up your system to attack, you just used the binaries to generate certificates, a part of openssl that is not vulnerable. The bug is in the communication channel binaries.
As to your apple devices, you might want to make sure that the latest version of their OS installed on them. Apple used to rely on OpenSSL in the past, but has been moving away from it for some time now. See: http://stackoverflow.com/a/7406994/736079. It looks like Apple moved away before the bug was introduced. Just make sure you check with Apple support or on their support website if you should take any actions.
