LWN: Comments on "That OpenSSL Worm"

How widespread, really?

ion++ — Sat, 21 Sep 2002 11:10:43 +0000

Not only Unix servers need compliant people to maintain them. All computers needs complaint and competent people to maintain them, it doesnt matter what kind of computer it is.

JonB

How widespread, really?

nas — Fri, 20 Sep 2002 13:39:02 +0000

I think the press is slightly exaggerating the spread of this worm. Read the story and it sounds like a Unix version of Code Red. When Code Red was in full force I saw tons of bogus requests in our server's access logs. When I heard about the OpenSSL worm I immediately setup an iptables logging rule on one of our machines to watch for it. I haven't seen a single packet on UDP port 2002.

I'm not saying Unix is not vulnerable to the same types of security problems as Windows. Unix servers need compliant people to maintain them.

That OpenSSL Worm

beejaybee — Thu, 19 Sep 2002 08:29:05 +0000

"In the unlikely event that you haven't already, applying the appropriate OpenSSL update might be a very good thing to do before reading any further."

Except you've probably already been hit :( Please don't be suckered into the delusion that applying the patch will cure an already-infected system.

This incident brings into sharp relief the necessity of staying on top of the (unfortunately, endless) job of keeping your systems patched.