I quickly wrote a script that outputs the openssl versions on AIX/Linux: #/bin/ksh# RUN THIS SCRIPT ON ANY AIX/LINUX TO DETECT IF THE SERVER IS VULNERABLE TO: # https://www.openssl.org/news/secadv_20140407.txt# https://www.us-cert.gov/ncas/alerts/TA14-098A# warning: if openssl was custom compiled (in a non-default dir...) and not in the PATH variable.. then this script will not detect it..# it works for RPM based Linux distros and AIX# LAST UPDATE: 2014.04.10 16hprintf `hostname -s`\t############################ AIX PARTfunction isaix {if which openssl > /dev/null 2>&1; then openssl version -a | head -1 | sed 's/^OpenSSL //g' | cut -d' ' -f1; else     RPM=`if which rpm > /dev/null 2>&1; then rpm -qa | grep -i ^openssl-[0-1]; fi`    LSLPP=`if which lslpp > /dev/null 2>&1; then lslpp -l | grep -i openssl; fi`    if [[ -n $RPM || -n $LSLPP ]]; then        printf OpenSSL NOT found in PATH but found installed package(s):         echo $RPM | perl -pe 's/\n/ /g'        echo $LSLPP | perl -pe 's/\n/ /g'        echo        else        echo OpenSSL NOT found in PATH and NOT found as installed package    fifi    }####################################################### LINUX PARTfunction islinux {if which openssl > /dev/null 2>&1; then openssl version -a | head -1 | sed 's/^OpenSSL //g' | cut -d' ' -f1; else     RPM=`if which rpm > /dev/null 2>&1; then rpm -qa | grep -i ^openssl-[0-1]; fi`    if [[ -n $RPM ]]; then        printf OpenSSL NOT found in PATH but found installed package(s):         echo $RPM | perl -pe 's/\n/ /g'        else        echo OpenSSL NOT found in PATH and NOT found as installed package    fifi    }###########################OSTYPE=`uname`    if echo ${OSTYPE} | grep -iq aix; then isaix; fi    if echo ${OSTYPE} | grep -iq linux; then islinux; fi+process the scripts output with a cat * and put that in an XLS or whateverOpenSSL versions 1.0.1 thru 1.0.1f are affected. My question: What is the best method to detect if a server is vulnerable to the bug or not? :) (besides this)
How to detect on Linux/AIX machines if they are vulnerable to the CVE-2014-0160?
openssl