Tag Info

Hot answers tagged

62

There is more to consider than just new certificates (or rather, new key pairs) for every affected server. It also means: Patching affected systems to OpenSSL 1.0.1g Revocation of the old keypairs that were just supersceded Changing all passwords Invalidating all session keys and cookies Evaluating the actual content handled by the vulnerable servers that ...


31

Yes. As you seem to be using a modern terminal emulator, some escape sequences could be used to modify Keyboard buffer. There could be injected proper shell commands. You could use argument -e of cat for safe operation, see man cat. Addendum In fact, it was possible, but in a very old past... As this become an issue, this kind of features was quickly ...


20

Directly copied from OpenSSL site OpenSSL Security Advisory [07 Apr 2014] TLS heartbeat read overrun (CVE-2014-0160) A missing bounds check in the handling of the TLS heartbeat extension can be used to reveal up to 64k of memory to a connected client or server. Only 1.0.1 and 1.0.2-beta releases of OpenSSL are affected including 1.0.1f and 1.0.2-beta1. ...


9

[edited] I made a tool to check the status of your SSL and see if heartbeat is enabled and vulnerable. Tool at: http://rehmann.co/projects/heartbeat/ There's another one at http://filippo.io/Heartbleed/ If you're vulnerable, please upgrade your OpenSSL packages & renew your certs!


7

Yes, it's a potential risk, see CVE-2003-0063, or CVE-2008-2383 or CVE-2010-2713, or CVE-2012-3515 or OSVDB 3881, or CVE-2003-0020 or any of the similar ones listed here... Some more in comments below also. Update it's not just a potential risk, it's a real risk. The current version of a popular terminal emulator has this problem, resulting in user-assisted ...


7

Modern OSes use virtual memory spaces for each process that leads to process isolation. So it is impossible for a webserver using the flawed OpenSSL library to read memory allocated to other processes (not explicitly shared with the process), at best attempts to do so would result in a segmentation fault. The truth is heartbleed is a simple overread of a ...


6

Typically there is no vulnerability, but obviously if you use it wrong, then you could create one. Printing the contents of a binary file produces beeps because character 7 is the old terminal command to make the machine beep, and some terminal programs still honor that command. But by design, there's nothing there that can hurt you. In the worst case, ...


5

"Real" glass terminals had an escape sequence to print the screen to a printer. They did this by running a command and pipeing the current screen contents to the printer's stdin. The command could be configured by another escape sequence. The classic way of exploiting this was to create files with names that embedded the escape sequence to set the printer ...


3

Note that if you're using a cloud based provider or content distribution network, and they are vulnerable, your website's leaking content will be mixed with content of all other websites using this provider. I've just just seen that with Incapsula, where a bank website's content was leaked along cryptocurrency website. They're fixed now fortunately.


3

Jspenguin wrote an offline tool to check if a server has the flaw. Download it, audit it, and run it. I also wrote ssl-heartbleed-check.pl (also an offline tool) to check if the OpenSSL used by your Perl stack (which on *n*x is often the openssl used by the whole system) is affected. This can help you to determine if you are affected on the client side. ...


3

...because what's going on is that you're compromising your own system. If you read the Old/New Thing blog, the author calls it "being on the other side of an airtight hatchway". It's like asking what's preventing people from entering your house - all your friends would ask "yes, but you lock your doors, don't you?"; you can "break into" your own house ...


2

Since I use php as an Apache module instead of CGI, and the http code was 404, I think nothing bad happened, right? right What was the attacker trying to do (or, if he was successful, what did he do) to my system? it was probably the first stage in a multi-stage-attacke(script); this is just the first scan, if you system is vulnerable or not.


2

I'm gonna add this info here without actual intention to answer my own question. The characters that can get injected on the command line while printing some other characters, better know as escape sequences, are defined really good on this site(Thanks F. Hauri, for mentioning it): http://vt100.net/docs/vt100-ug/chapter3.html Under chapter: Reports ...


2

What you are seeing is xterm control sequences. Control sequences are activated when they are seen in output in the terminal; e.g., when you cat a file with bytes that are non-printable ASCII. In your example, the control sequence is ESC Z (bytes 1B 5A) which returns the terminal ID -- as a command in the terminal. You can try it yourself: echo -e ...


2

From what I understand, it's the luck of the draw. You may get sensitive information or nothing at all. It all depends what happens to reside in the memory the exploit is pushing out to you. This can include private keys as the server process will cache this for quick access during SSL transmissions, but from my limited testing I was able to fetch HTTP ...


2

No - it does not mean you are not vulnerable. The patches you have installed may have fixed the particular vulnerability, but failure of a test does not automatically mean you are safe - it could just be the case that your test version is misconfigured, failed due to a local configuration or bug, or has had some other problem. The usual way to gain ...


1

You can do this a few different ways. First, if your exploit is an EXE-dropping exploit (like psexec), you can set the EXE::Custom advanced option. Otherwise you can use one of the payloads that allows you to upload (windows/upexec/*) or download (windows/download_exec) a custom executable.



Only top voted, non community-wiki answers of a minimum length are eligible