Time to update OpenSSL 0.9.8m (24 Mar 2010)
If you're using OpenSSL 0.9.8m as either a client or server (but esp as a server) then it's time to update to 0.9.8n.
OpenSSL Security Advisory [24 March 2010] "Record of death" vulnerability in OpenSSL 0.9.8f through 0.9.8m ================================================================ In TLS connections, certain incorrectly formatted records can cause an OpenSSL client or server to crash due to a read attempt at NULL. Affected versions depend on the C compiler used with OpenSSL: - If 'short' is a 16-bit integer, this issue applies only to OpenSSL 0.9.8m. - Otherwise, this issue applies to OpenSSL 0.9.8f through 0.9.8m. Users of OpenSSL should update to the OpenSSL 0.9.8n release, which contains a patch to correct this issue. If upgrading is not immediately possible, the source code patch provided in this advisory should be applied. Bodo Moeller and Adam Langley (Google) have identified the vulnerability and prepared the fix.