OpenSSL is an open-source implementation of the SSL and TLS protocols.

learn more… | top users | synonyms

1
vote
1answer
156 views

Doesn't the Heart Bleed vulnerability imply that we need to change passwords for *all* systems? [duplicate]

I understand the part about a server with the vulnerability. But from what I gather, the vulnerability has also existed in browsers that use the vulnerable OpenSSL implementations. So, if I first ...
5
votes
1answer
3k views

OpenSSL Heartbeat (Heartbleed bug) - what's the payload used for? [duplicate]

So the heartbeat bug can lead to memory read overrun, exposing (parts of) the process memory, because it reads the payload when there actually is no (or less) payload. But what do you need a payload ...
206
votes
11answers
32k views

How to explain Heartbleed without technical terms?

Most of my friends who are not experienced in computers want to know what Heartbleed is and how it works. How would one explain Heartbleed to someone without a technical background?
5
votes
4answers
2k views

Heartbleed: OpenSSL v 0.9.8o and OpenVPN v 2.1.3 Reporting Vulnerable

According to the OpenSSL project the version in use on a server we control is not vulnerable: 0.9.8o. According to OpenVPN v 2.1.3 is also not vulnerable (also in use). These are running on Debian ...
11
votes
2answers
1k views

Does having 2-factor authentication help with HeartBleed?

I was talking with a friend about HeartBleed, and he mentioned that he had 2-factor authentication enabled on all the sites that supported it, so even with his username and passwords, nobody would be ...
9
votes
4answers
3k views

Do I need to worry about my SSH keys if my system was vulnerable to Heartbleed?

So I'm getting conflicting information from members of my team. The premise is, if an attacker can keep requesting 64 kb chunks of memory from my server, they could get the entire memory footprint of ...
3
votes
1answer
707 views

Heartbleed - Blown out of proportion? [duplicate]

From what I gather you need local memory based access correct to even access the private key? Is all this talk and worry of "Was I hacked?!" "Heartbleed just made you full hackable" ect... really over ...
1
vote
1answer
620 views

Heartbleed and Facebook logins on (once) vulnerable sites [duplicate]

Users have been advised to consult a list of sites affected by heartbleed and to change their passwords on those sites once they are no longer vulnerable. Facebook appears to have been unaffected; but ...
3
votes
0answers
161 views

Does heartbleed have any effect if OpenSSL was only used to generate the certificate [duplicate]

Edit: Please follow the above link to the original. I have a self-signed certificate which is use to sign other certificates that I issued. This is all done with an affected version of OpenSSL. ...
1
vote
1answer
236 views

OpenSSL exploit [closed]

I have read about recent vulnerability in openssl. I tried to exploit one of my cloud servers where I run my web sites. I managed to get 64 KB of data. But what I managed to get was only HTML, CSS, ...
2
votes
1answer
208 views

Does the Heartbeat Openssl Bug also affect Servers who enforce Client Authentication?

Regarding the priority to upgrade servers, I want to confirm this, as I read in https://tools.ietf.org/html/rfc6520 chapter 3: However, a HeartbeatRequest message SHOULD NOT be sent during ...
11
votes
3answers
8k views

How paranoid should the average user be about heartbleed? [duplicate]

Questions about Heartbleed have been showing up in the popular questions list today since morning, from the security stack exchange to android I have been reading many of them, most of them are ...
1
vote
1answer
1k views

Is a mongodb build that uses the -ssl option vulnerable to heartbleed?

If one is using MongoDB enterprise, or built MongoDB from source using the -ssl option (as described here), is that MongoDB vulnerable to the heartbleed bug? I know mongo needed openssl-devel to be ...
7
votes
1answer
3k views

Has Linux Mint updated the OpenSSL library for LMDE (Heartbleed bug)? [closed]

Background I am using Linux Mint for one of my servers and have been trying to find out if the Linux Mint Debian Edition(LMDE) has updated their repositories with patches for the OpenSSL bug. I ...
1
vote
1answer
13k views

How can I tell if a site is using open SSL, and which version? [duplicate]

In light of the Open SSL Heartbleed bug, I'd like to make sure I'm not putting any personal information in any system that is using Open SSL that is vulnerable. So, from my browser (IE 11) how can I ...
7
votes
1answer
1k views

Does Heartbleed affect servers if OpenSSL was only used to generate the certificate?

I built an application that generates certificate signing requests (CSRs) using the PHP OpenSSL module. Is there a way that the HeartBleed bug can affect these (in use) private keys and CSRs that ...
3
votes
1answer
356 views

Where/what is the actual HeartBleed bug? [duplicate]

I've read lots of reports of the HeartBleed bug but have not been able to find a description at the source-code level, such as this one for the goto fail bug. Can anyone provide, or point to, such an ...
4
votes
2answers
360 views

Are there any known Heartbleed attacks?

Are there any known instances of malicious security breeches exploiting the Heartbleed vulnerability? Or is there at present only a known vulnerability, albeit a very serious one?
2
votes
1answer
135 views

Does OpenSSL leave any traces that a server uses it?

I was thinking that maybe the banners can give some insight as to whether a server is using OpenSSL. Is there any tell tale signs that a server is using OpenSSL? -- Clarification: Speaking in terms ...
16
votes
5answers
5k views

Would the Heartbleed bug have been prevented if OpenSSL was written in Go/D/Vala?

IIUC the Heartbleed vulnerability happens due to a bug in the C source code of OpenSSL, by performing a memcpy() from a buffer that is too short. I'm wondering if the bug would have been prevented ...
6
votes
1answer
3k views

What are the side effects of recompiling OpenSSL with -DOPENSSL_NO_HEARTBEATS?

Sorry if it is very open ended. All the news about the Heartbleed exploit has been flooding Google, and I can't figure out what it does. Is it fine to recompile?
13
votes
4answers
26k views

Does the HeartBleed vulnerability affect Apache Tomcat servers using Tomcat Native?

Are Apache Tomcat servers using Tomcat Native & APR vulnerable to the HeartBleed OpenSSL bug, or does this layer insulate them? http://tomcat.apache.org/native-doc/ HeartBleed OpenSSL bug ...
0
votes
2answers
1k views

Where is the first online reference to the “HeartBleed” bug?

From what I know, the HeartBleed bug seems to occur around 15 hours ago. As per heartbleed.com, the HeartBleed bug was independently discovered by a team of security engineers at Codenomicon. How did ...
56
votes
2answers
22k views

Does the heartbleed vulnerability affect clients as severely?

If I have a web crawler (using a non-patched version of OpenSSL) that can be coaxed to connect to an evil https-site, can they get everything from my process memory? To attack a server you can keep ...
9
votes
1answer
1k views

Heartbleed how to find out applications using statically compiled version of openssl?

We're analysing issue at work and I wondering how to find out if there's any binary with a statically compiled version of openssl which includes this bug. Would it be possible to find a fingerprint ...
19
votes
2answers
6k views

Can Heartbleed be used to obtain memory from other processes?

According to http://heartbleed.com/, memory contents can be leaked from the server to the client and vice versa. Say that I have been banking in a separate browser profile (but under the same user). ...
188
votes
1answer
63k views

How exactly does the OpenSSL TLS heartbeat (Heartbleed) exploit work?

I've been hearing more about the OpenSSL Heartbleed attack, which exploits some flaw in the heartbeat step of TLS. If you haven't heard of it, it allows people to: Steal OpenSSL private keys Steal ...
9
votes
1answer
1k views

Are networks using EAP-TLS affected by Heartbleed?

Does the Heartbleed bug affect WiFi networks secured by WPA2-EAP in TLS mode? Since it's using TLS to secure connections between the server and clients, is it possible to attack the server using the ...
27
votes
6answers
17k views

Heartbleed and Routers/ASAs/other

OK, so I first heard about heartbleed a few hours ago through the stack exchange questions feed, and after a moments panic, realised that the only web servers I have secured via OpenSSL are on the ...
48
votes
2answers
7k views

What should end-users do about Heartbleed?

What should one do about the Heartbleed OpenSSL exploit? mainly talks about what people running websites should do about Heartbleed. What should end-users of websites be doing? Do they need to ...
108
votes
5answers
55k views

What should a website operator do about the Heartbleed OpenSSL exploit?

CVE-2014-0160 http://heartbleed.com This is supposed to be a canonical question on dealing with the Heartbeat exploit. I run an Apache web server with OpenSSL, as well as a few other utilities ...
57
votes
4answers
26k views

Does Heartbleed mean new certificates for every SSL server?

If you haven't heard of the Heartbleed Bug, it's something to take a look at immediately. It essentially means that an attacker can exploit a vulnerability in many versions of OpenSSL to be able to ...
0
votes
1answer
368 views

ssl client authentication: check only one certificate VS certs signed from a ca

i'm about to secure a webservice with client authentication. (apache2, mod_ssl, openssl). from what i googled, i found that it's more common to have a ca, which signs the client certs, which will ...
4
votes
2answers
4k views

What is the difference between Diffie Hellman generator 2 and 5?

Generating Diffie Hellman parameters in OpenSSL can be done as follows: $ openssl dhparam -out dh2048.pem 2048 Generating DH parameters, 2048 bit long safe prime, generator 2 This is going to take a ...
2
votes
2answers
443 views

Why do public key certificate “Trust anchor”? Does this introduce a single point of failure?

When you look at currently used concept of Root CA (primarily in SSL/TLS context), you can see a single-point-of-failure vulnerability, which means, if your private key is disclosed, you automatically ...
0
votes
3answers
408 views

Up to date books for OpenSSL coverage of TLS 1.1 and 1.2 [closed]

I currently have Implementing SSL / TLS Using Cryptography and PKI Joshua Davies. It is very recent and covers even newer TLS version 1.1 and 1.2 and ECC. It is based on many C sample that are ...
1
vote
2answers
195 views

How secure is my system?

I am creating an application that allows a user to create an account, with a password, and have a set of public and private keys symmetrically encrypted with the password, so that they can be ...
1
vote
1answer
349 views

Risks associated with distributing encrypted private key with our software?

Our software contains two executables that need to serve data over SSL (and several that need to do requests over HTTPS)). I notice that it is distributed with some .PEM files created with OpenSSL. ...
0
votes
1answer
92 views

Storing third party auth info; Is this secure?

I have a feature request to connect my PHP web-app to the users mail server. I have usually strayed away from this type of work as it will mean storing the users email passwords. My question: is it ...
0
votes
2answers
28k views

SSL Handshake failed

I’m working on windows desktop application which is created using C++ (IDE : Qt creator). It has login panel, where i do user validation via https connection using openssl 1.0 library. Application is ...
1
vote
2answers
450 views

why are the first few characters of a DSA Private Key similar?

I noticed most DSA private keys often start with the same few characters, MIIBvAIBAAKBgQD . For example, generate a private key on Ubuntu, by running: ssh-keygen -t dsa -N '' -f /tmp/id_dsa This ...
1
vote
1answer
120 views

How does a CA add www and raw domain names to my cert when my CSR doesn't have them?

I'm in the process of buying an SSL cert, and I'm confused by this part: Many CAs say they'll add www. to your domain, so that e.g. if you buy a single-domain cert app.example.com, they'll also add ...
0
votes
2answers
96 views

What influences the speed of rendered php page using encryption [closed]

I've built a web app which uses the openssl_private_decrypt() functions. The rendering of a page with 15 messages encrypted with these functions takes remarkely longer as the ones without. (3-4 ...
1
vote
3answers
219 views

How to minimise risk to sensitive data in temp files in shared hosting environment before encryption?

openssl_pkcs7_encrypt() requires the data to be encrypted to be read from a file and so unfortunately it requires sensitive data to be written to temporary file before being encrypted. In a shared ...
0
votes
2answers
2k views

Attack on old OpenSSL/Debian vulnerability doesn't work on a vulnerable box

DISCLAIMER: The vulnerable box that we are testing on belongs to us, and all the actions are under surveilence, hence we are not doing anything illegal here. I'm testing a Ubuntu 8.04 box, it's known ...
0
votes
2answers
2k views

Is using an SSL Session ID along with a cookie based session verification more secure or not really?

I am using Django which is a web framework for Python. I love it but the session handling is cookie-based. Now over SSL I'm sure it's reasonably "secure" but I don't think there is any kind of fail ...
1
vote
2answers
924 views

Does critical SubjectAltName IP:x.x.x.x on an SSL client certificate limit where the certificate can be used from?

I have a requirement to limit SSL certificates by source IP. Would setting a critical SubjectAltName limit this (server side validation is by OpenSSL via nginx)? If not, how could this be ...
2
votes
1answer
221 views

Use of openssl could be a weak point in an Android App?

I'm reviewing an Android app (consists of Java and C source). There are complicated obfuscation steps in the build process (for content protection). But it uses statically linked openssl library ...
2
votes
2answers
294 views

Is it possible to sign a certificate such that the issuer is different than in the CA's certificate?

Lets say I have a self-signed root certificate called root-ca.pem created by openssl. It allows me to sign certificates. Is it possible sign new.csr certificate with root-ca.pem such that the issuer ...
3
votes
1answer
3k views

OpenSSL Secure Renegotiation

Has anyone tried to do secure renegotiation on OpenSSL and verify it using WireShark? I can't seem to do a secure renegotiation as far as RFC 5746 is concerned. I tried to issue the connection ...