CVE-2014-0160: Updating OpenSSL library on RightImage

For Running Servers

On a running Ubuntu 12.04-LTS server, navigate to the server's Scripts tab in the dashboard and run the recipe rightscale::setup_security_updates which you can find in the Boot Scripts section. In the confirmation window, click the "Show advanced" option and select "text: enable" from the dropdown then click Continue. (Note: This will ONLY unfreeze the security repository, which will allow the latest security updates to be installed.)

After the recipe is successfully completed, verify if the repository was properly changed:

root@ip-172-31-31-200:~# cat /etc/apt/sources.list.d/rightscale.sources.list |grep -i security
deb http://cf-mirror.rightscale.com/ubuntu_daily/latest precise-security main restricted multiverse universe
deb http://island5.rightscale.com/ubuntu_daily/latest precise-security main restricted multiverse universe

Once the security repository has been changed, you can proceed to apply the security update on the server by running the rightscale::do_security_updates operational script, which will do a system package update to download and install the latest security patches.

Again, once the recipe is completed, you can ssh into the server to verify that the 'openssl' package was properly updated to the latest version:

root@ip-172-31-17-180:/etc/apt# dpkg -l libssl1.0.0 openssl
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name                                 Version                              Description
+++-====================================-====================================-========================================================================================
ii  libssl1.0.0                          1.0.1-4ubuntu5.12                    SSL shared libraries
ii  openssl                              1.0.1-4ubuntu5.12                    Secure Socket Layer (SSL) binary and related cryptographic tools

For New Servers

For new servers that you're going to launch, make sure to enable the security update input, which can be found in the RIGHTSCALE category. (Note: It's an advanced input so you must click on the "Show advanced inputs" option to see it in the dashboard.

Enable security updates
rightscale/security_updates
text:enable