On Monday, April 7, a team of researchers made public a significant vulnerability to OpenSSL, called “Heartbleed.” OpenSSL is a core component of the Internet affecting how Internet communications are secured and encrypted. The vulnerability exists in certain versions (1.01 a-f) of the core library. The dangers presented by this vulnerability are that it is widespread, invisible to detection and logging systems, and has been in existence for a long period of time. The risk presented to you is that sensitive data like passwords may have been able to be retrieved by unauthorized third parties.
Steps we have taken, and what you are advised to do:
To help protect our customers from the impact of this vulnerability, we have moved quickly to ensure that none of our services are using this library. Where appropriate, these services and systems have been patched. Because of the impossibility of determining whether this exploit has been undertaken on our systems, we are recommending the following activity by you as soon as possible:
- You should immediately change any and all passwords that you use to access our systems.
- If you are a user of our Virtual Private Server product (VPS Hosting) and have installed a version of OpenSSL on your server that differs from the one we provide, you should immediately check its version number and replace it, if it is one of the affected versions (1.0.1a-f).
Again, there is no proof that any data has been shared inappropriately, but as a matter of safety and security, you should act quickly to change your passwords for all Web.com, Network Solutions, and Register.com systems, and elsewhere on the Web.
Full details of the vulnerability, including more technical details, can be found at: http://heartbleed.com/.
Thank you,
The Security Team at Web.com, Network Solutions, and Register.com
Google+Brought to you by Network Solutions®, a Web.com® service.
