Are our https pages secure from the Heartbleed bug?

Jen Mackinder

The Heartbleed bug in OpenSSL means that any website with HTTPS encryption is vulnerable to attack. Users can tell if a website uses HTTPS security if the see "https" at the beginning of a URL.



Read more: http://www.upi.com/Business_News/2014...

Greg Milton

Recently, a team of security researchers announced a vulnerability named “Heartbleed” (CVE 2014 0160) which affects SSL, the protocol most commonly used to secure transmission of sensitive data on the web, from credit cards to personal information, and the very keys that protect that data.



More specifically, however, this vulnerability only affects software that uses the OpenSSL cryptographic libraries, typically based on Linux. It does not affect all software that uses SSL; only software based on OpenSSL.



The following products within Blackbaud Hosted Services are NOT vulnerable to the "Heartbleed" bug from external threats, as they do not use the OpenSSL libraries:

• Blackbaud Payment Service
• Blackbaud Merchant Services
• Blackbaud Secure Pay
• Blackbaud CRM
• Blackbaud NetCommunity, BBIS and related products such as Spark
• Blackbaud Netsolutions
• Sphere
• The Raiser’s Edge
• Financial Edge
• Education Edge
• FAWeb and NetClassroom
• ALTRU
• ResearchPoint
• eTapestry

Luminate Online use OpenSSL but are protected from the external threat of the Heartbleed vulnerability by other mitigating controls within our Hosted architecture. We will be addressing any residual internal risk by patching the product per PCI standards, but Luminate Online are still PCI compliant and safe to use for customers and their constituents.



Additionally, we have externally tested Team Approach and Donor Direct and they are not vulnerable to this issue.



We regularly and frequently test and scan our Hosted products as part of our regular security program, and as of today we have tested all of the above products specifically for this vulnerability and verified they are not affected.