Feeds

Amazon carefully stitches up Heartbleed OpenSSL hole

Bezos & Co patch mammoth web infrastructure to stop memory-leaking frightener

Next gen security for virtualised datacentres

Amazon is working to patch "Heartbleed" memory-leak vulnerablities in its Amazon Web Services hosting infrastructure.

The mammoth cloud company confirmed on Tuesday that it has dealt with some of the parts of its infrastructure that were vulnerable to the nasty OpenSSL 1.0.1 bug nicknamed "Heartbleed" that was disclosed on Monday. However, as of the time of writing it hadn't sealed all the holes.

The Heartbleed bug lets nefarious actors reveal up to 64KB of memory of systems using OpenSSL, potentially compromising the keys used to "identify the service providers and to encrypt the traffic, the names and passwords of the users and the actual content."

Given that Amazon's cloud division Amazon Web Services both uses OpenSSL and gives its tens of thousands of cloud customers the option of using it as well, the disclosure of the bug was disconcerting.

At the time of writing, Amazon said it had dealt with all its Elastic Load Balancers affected by Heartbleed, apart from those in its vast "US-EAST-1" data center region.

"The vast majority of load balancers have been updated and we continue to work on the remaining load balancers and expect them to be updated within the next few hours," it said.

It also confirmed that it had mitigated the vulnerability within Amazon CloudFront, and was working with "a small number of customers" of its AWS Elastic Beanstalk platform-as-a-service to help them deal with it as well.

Customers of its mainstay EC2 compute service, however, who are using OpenSSL on their own Linux images will need to update the images to protect themselves.

As an added precaution, Amazon says admins of gear in its cloud estates should rotate any SSL certificates used to further deal with the frightening bug.

As for Amazon's rivals? The bug was disclosed by a Google employee, so Google Compute Engine is safe and Microsoft's Azure cloud doesn't use OpenSSL. ®

Gartner critical capabilities for enterprise endpoint backup

More from The Register

next story
The Return of BSOD: Does ANYONE trust Microsoft patches?
Sysadmins, you're either fighting fires or seen as incompetents now
Microsoft: Azure isn't ready for biz-critical apps … yet
Microsoft will move its own IT to the cloud to avoid $200m server bill
Shoot-em-up: Sony Online Entertainment hit by 'large scale DDoS attack'
Games disrupted as firm struggles to control network
Cutting cancer rates: Data, models and a happy ending?
How surgery might be making cancer prognoses worse
Silicon Valley jolted by magnitude 6.1 quake – its biggest in 25 years
Did the earth move for you at VMworld – oh, OK. It just did. A lot
Forrester says it's time to give up on physical storage arrays
The physical/virtual storage tipping point may just have arrived
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
5 things you didn’t know about cloud backup
IT departments are embracing cloud backup, but there’s a lot you need to know before choosing a service provider. Learn all the critical things you need to know.
Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?