before upgrading to UTM 9.111-7, I issued "[FONT="Courier New"]lsof | grep libssl[/FONT]" on the command line of my UTM9. I showed about two dozen lines, containing "libssl.so.1.0.0". Nothing else. So I thought: "Why is UTM9 vulnerable, if libssl.1.0.1 is not installed?"
Now, after upgrading to UTM 9.111-7, here's the output of "[FONT="Courier New"]lsof | grep libssl[/FONT]":
syslog-ng 3250 root mem REG 8,6 399496 145822 /usr/lib/libssl.so.1.0.0
syslog-ng 3251 root mem REG 8,6 399496 145822 /usr/lib/libssl.so.1.0.0
confd.plx 3636 root mem REG 8,6 399496 145822 /usr/lib/libssl.so.1.0.0
aua.bin 3729 root mem REG 8,6 399496 145822 /usr/lib/libssl.so.1.0.0
confd.plx 3943 root mem REG 8,6 399496 145822 /usr/lib/libssl.so.1.0.0
openvpn 5025 root mem REG 8,6 399496 15855 /var/sec/chroot-openvpn/usr/lib/libssl.so.1.0.0
exim 5458 smtp mem REG 8,5 399496 2096207 /var/storage/chroot-smtp/usr/lib/libssl.so.1.0.0
aua_edirs 5659 root mem REG 8,6 399496 145822 /usr/lib/libssl.so.1.0.0
acc-agent 5801 root mem REG 8,6 399496 145822 /usr/lib/libssl.so.1.0.0
master 6046 root mem REG 8,6 399496 145822 /usr/lib/libssl.so.1.0.0
red_serve 6065 root mem REG 8,6 399496 145822 /usr/lib/libssl.so.1.0.0
red_serve 6377 root mem REG 8,6 399496 145822 /usr/lib/libssl.so.1.0.0
red_serve 6439 root mem REG 8,6 399496 145822 /usr/lib/libssl.so.1.0.0
pluto 6887 root mem REG 8,6 399496 15817 /var/sec/chroot-ipsec/usr/lib/libssl.so.1.0.0
qmgr 8470 postfix mem REG 8,6 399496 145822 /usr/lib/libssl.so.1.0.0
pickup 18074 postfix mem REG 8,6 399496 145822 /usr/lib/libssl.so.1.0.0
service_m 18214 root mem REG 8,6 399496 145822 /usr/lib/libssl.so.1.0.0
httpproxy 20395 httpproxy mem REG 8,6 399496 145822 /usr/lib/libssl.so.1.0.0
httpd 20606 root mem REG 8,6 399496 2299 /var/sec/chroot-httpd/usr/lib/libssl.so.1.0.0
httpd 20609 wwwrun mem REG 8,6 399496 2299 /var/sec/chroot-httpd/usr/lib/libssl.so.1.0.0
httpd 20610 wwwrun mem REG 8,6 399496 2299 /var/sec/chroot-httpd/usr/lib/libssl.so.1.0.0
confd.plx 20790 root mem REG 8,6 399496 145822 /usr/lib/libssl.so.1.0.0
confd.plx 21008 root mem REG 8,6 399496 145822 /usr/lib/libssl.so.1.0.0
httpd 21150 wwwrun mem REG 8,6 399496 2299 /var/sec/chroot-httpd/usr/lib/libssl.so.1.0.0
confd.plx 21197 root mem REG 8,6 399496 145822 /usr/lib/libssl.so.1.0.0
cleanup 21389 postfix mem REG 8,6 399496 145822 /usr/lib/libssl.so.1.0.0
trivial-r 21390 postfix mem REG 8,6 399496 145822 /usr/lib/libssl.so.1.0.0
smtp 21392 postfix mem REG 8,6 399496 145822 /usr/lib/libssl.so.1.0.0
Not much changed, as far as I can see. Did the latest UTM-update not introduce libssl v1.0.1g?
So was it just the SSL-VPN-client, that was affected?
This thread was automatically locked due to age.
