Feeds

Amazon carefully stitches up Heartbleed OpenSSL hole

Bezos & Co patch mammoth web infrastructure to stop memory-leaking frightener

7 Elements of Radically Simple OS Migration

Amazon is working to patch "Heartbleed" memory-leak vulnerablities in its Amazon Web Services hosting infrastructure.

The mammoth cloud company confirmed on Tuesday that it has dealt with some of the parts of its infrastructure that were vulnerable to the nasty OpenSSL 1.0.1 bug nicknamed "Heartbleed" that was disclosed on Monday. However, as of the time of writing it hadn't sealed all the holes.

The Heartbleed bug lets nefarious actors reveal up to 64KB of memory of systems using OpenSSL, potentially compromising the keys used to "identify the service providers and to encrypt the traffic, the names and passwords of the users and the actual content."

Given that Amazon's cloud division Amazon Web Services both uses OpenSSL and gives its tens of thousands of cloud customers the option of using it as well, the disclosure of the bug was disconcerting.

At the time of writing, Amazon said it had dealt with all its Elastic Load Balancers affected by Heartbleed, apart from those in its vast "US-EAST-1" data center region.

"The vast majority of load balancers have been updated and we continue to work on the remaining load balancers and expect them to be updated within the next few hours," it said.

It also confirmed that it had mitigated the vulnerability within Amazon CloudFront, and was working with "a small number of customers" of its AWS Elastic Beanstalk platform-as-a-service to help them deal with it as well.

Customers of its mainstay EC2 compute service, however, who are using OpenSSL on their own Linux images will need to update the images to protect themselves.

As an added precaution, Amazon says admins of gear in its cloud estates should rotate any SSL certificates used to further deal with the frightening bug.

As for Amazon's rivals? The bug was disclosed by a Google employee, so Google Compute Engine is safe and Microsoft's Azure cloud doesn't use OpenSSL. ®

Best practices for enterprise data

More from The Register

next story
Sysadmin Day 2014: Quick, there's still time to get the beers in
He walked over the broken glass, killed the thugs... and er... reconnected the cables*
VMware builds product executables on 50 Mac Minis
And goes to the Genius Bar for support
Multipath TCP speeds up the internet so much that security breaks
Black Hat research says proposed protocol will bork network probes, flummox firewalls
Auntie remains MYSTIFIED by that weekend BBC iPlayer and website outage
Still doing 'forensics' on the caching layer – Beeb digi wonk
Microsoft's Euro cloud darkens: US FEDS can dig into foreign servers
They're not emails, they're business records, says court
Microsoft says 'weird things' can happen during Windows Server 2003 migrations
Fix coming for bug that makes Kerberos croak when you run two domain controllers
Cisco says network virtualisation won't pay off everywhere
Another sign of strain in the Borg/VMware relationship?
prev story

Whitepapers

7 Elements of Radically Simple OS Migration
Avoid the typical headaches of OS migration during your next project by learning about 7 elements of radically simple OS migration.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Solving today's distributed Big Data backup challenges
Enable IT efficiency and allow a firm to access and reuse corporate information for competitive advantage, ultimately changing business outcomes.
A new approach to endpoint data protection
What is the best way to ensure comprehensive visibility, management, and control of information on both company-owned and employee-owned devices?