I see in the news about the “Heartbleed” security bug. As an end user, do I need to do anything about it?
You can find basic information at http://heartbleed.com/
More technical information is available from:
For those who aren’t end users, see this question on serverfault:
You should also upgrade your TLS/SSL clients that use OpenSSL as soon as fixed version is available. Particularly FTPS (FTP over TLS/SSL) clients.
Fortunately exploit of the vulnerability in clients is less probable than in servers.
As a Linux user, I had OpenSSL 1.0.1e installed on my Debian 7.0 (wheezy) install.
To fix it, I did this:
This re-installs OpenSSL and replaces it with 1.0.1e-2, the fixed OpenSSL for Debian Wheezy.
The major issue is really on the server side, but it is a good idea to upgrade your client OpenSSL if it's installed, just to be sure. See Debian Security Advisory, DSA-2896-1 openssl -- security update for further information.