Skip to main content
added 313 characters in body
Source Link
ack__
  • 2.8k
  • 16
  • 25

Yes it affects clients as severly, as stated on the heartbleed website:

Furthermore you might have client side software on your computer that could expose the data from your computer if you connect to compromised services.

Of course, and this is not just the case for this vulnerability or for a particular client, the client still has to initiate the connection to be attacked. In no way this vulnerability allows an attacker to initiate a connection to your web crawler and exploit the vulnerability.

In your case however, as you have a direct control over the OpenSSL client code (and I suppose this is the case based on your post), you want to ensure that your version of OpenSSL doesn't come with the Heartbeat option, and if it does, to remove it.

To see which options were used to compile your version of OpenSSL, use:

openssl version -o

And In order to compile OpenSSL without Heartbeat supportdo so, simply use this flag when compiling you can:

-DOPENSSL_NO_HEARTBEATS
  • display which specific options were used to compile your version of OpenSSL :

    openssl version -o

  • or display every information from your OpenSSL version :

    openssl version -a

  • compile OpenSSL without Heartbeat support, by simply using this flag at compile time :

    -DOPENSSL_NO_HEARTBEATS

Once this is done, or if your version of OpenSSL didn't include it initially, then you are not vulnerable.

Edit: Another method is to retrieve your OpenSSL version with:

openssl version

And compare it to the list of affected versions available on heartbleed :

  • OpenSSL 1.0.1 through 1.0.1f (inclusive) are vulnerable
  • OpenSSL 1.0.1g is NOT vulnerable
  • OpenSSL 1.0.0 branch is NOT vulnerable
  • OpenSSL 0.9.8 branch is NOT vulnerable

Yes, as stated on the heartbleed website:

Furthermore you might have client side software on your computer that could expose the data from your computer if you connect to compromised services.

Of course, and this is not just the case for this vulnerability or for a particular client, the client still has to initiate the connection to be attacked. In no way this vulnerability allows an attacker to initiate a connection to your web crawler and exploit the vulnerability.

In your case however, as you have a direct control over the OpenSSL client code (and I suppose this is the case based on your post), you want to ensure that your version of OpenSSL doesn't come with the Heartbeat option, and if it does, to remove it.

To see which options were used to compile your version of OpenSSL, use:

openssl version -o

And to compile OpenSSL without Heartbeat support, simply use this flag when compiling :

-DOPENSSL_NO_HEARTBEATS

Once this is done, or if your version of OpenSSL didn't include it initially, then you are not vulnerable.

Yes it affects clients as severly, as stated on the heartbleed website:

Furthermore you might have client side software on your computer that could expose the data from your computer if you connect to compromised services.

Of course, and this is not just the case for this vulnerability or for a particular client, the client still has to initiate the connection to be attacked. In no way this vulnerability allows an attacker to initiate a connection to your web crawler and exploit the vulnerability.

In your case however, as you have a direct control over the OpenSSL client code (and I suppose this is the case based on your post), you want to ensure that your version of OpenSSL doesn't come with the Heartbeat option, and if it does, to remove it. In order to do so, you can:

  • display which specific options were used to compile your version of OpenSSL :

    openssl version -o

  • or display every information from your OpenSSL version :

    openssl version -a

  • compile OpenSSL without Heartbeat support, by simply using this flag at compile time :

    -DOPENSSL_NO_HEARTBEATS

Once this is done, or if your version of OpenSSL didn't include it initially, then you are not vulnerable.

Edit: Another method is to retrieve your OpenSSL version with:

openssl version

And compare it to the list of affected versions available on heartbleed :

  • OpenSSL 1.0.1 through 1.0.1f (inclusive) are vulnerable
  • OpenSSL 1.0.1g is NOT vulnerable
  • OpenSSL 1.0.0 branch is NOT vulnerable
  • OpenSSL 0.9.8 branch is NOT vulnerable
added 313 characters in body
Source Link
ack__
  • 2.8k
  • 16
  • 25

Yes, as stated on the heartbleed website:

Furthermore you might have client side software on your computer that could expose the data from your computer if you connect to compromised services.

Of course, and this is not just the case for this vulnerability or for a particular client, the client still has to initiate the connection to be attacked. In no way this vulnerability allows an attacker to initiate a connection to your web crawler and exploit the vulnerability.

In your case however, whereas you have a direct control over the OpenSSL client code (and I suppose this is the case based on your post), you havewant to ensure that your version of OpenSSL doesn't come with the Heartbeat option, and if it does, to remove it.

To see which options were used to compile your version of OpenSSL, use:

openssl version -o

And to compile OpenSSL without Heartbeat support, simply use this optionflag when compiling :

-DOPENSSL_NO_HEARTBEATS

IfOnce this is done, or if your version of OpenSSL didn't include it initially, then you are not vulnerable.

Yes, as stated on the heartbleed website:

Furthermore you might have client side software on your computer that could expose the data from your computer if you connect to compromised services.

In your case however, where you have a direct control over the OpenSSL client code (and I suppose this is the case based on your post), you have to ensure that your version of OpenSSL doesn't come with the Heartbeat option.

To see which options were used to compile your version of OpenSSL, use:

openssl version -o

And to compile OpenSSL without Heartbeat support, simply use this option when compiling :

-DOPENSSL_NO_HEARTBEATS

If this is done, or if your version of OpenSSL didn't include it initially, then you are not vulnerable.

Yes, as stated on the heartbleed website:

Furthermore you might have client side software on your computer that could expose the data from your computer if you connect to compromised services.

Of course, and this is not just the case for this vulnerability or for a particular client, the client still has to initiate the connection to be attacked. In no way this vulnerability allows an attacker to initiate a connection to your web crawler and exploit the vulnerability.

In your case however, as you have a direct control over the OpenSSL client code (and I suppose this is the case based on your post), you want to ensure that your version of OpenSSL doesn't come with the Heartbeat option, and if it does, to remove it.

To see which options were used to compile your version of OpenSSL, use:

openssl version -o

And to compile OpenSSL without Heartbeat support, simply use this flag when compiling :

-DOPENSSL_NO_HEARTBEATS

Once this is done, or if your version of OpenSSL didn't include it initially, then you are not vulnerable.

added 335 characters in body
Source Link
ack__
  • 2.8k
  • 16
  • 25

Yes, as stated on the heartbleed website:

Furthermore you might have client side software on your computer that could expose the data from your computer if you connect to compromised services.

In your case however, where you have a direct control over the OpenSSL client code (and I suppose this is the case based on your post), you have to ensure that your version of OpenSSL doesn't come with the Heartbeat option.

To see which options were used to compile your version of OpenSSL, use:

openssl version -o

And to compile OpenSSL without Heartbeat support, simply use this option when compiling :

-DOPENSSL_NO_HEARTBEATS

If this is done, or if your version of OpenSSL didn't include it initially, then you are not vulnerable.

In your case, where you have a direct control over the OpenSSL client code (and I suppose this is the case based on your post), you have to ensure that your version of OpenSSL doesn't come with the Heartbeat option.

To compile OpenSSL without Heartbeat, simply use this option when compiling :

-DOPENSSL_NO_HEARTBEATS

If this is done, or if your version of OpenSSL didn't include it initially, then you are not vulnerable.

Yes, as stated on the heartbleed website:

Furthermore you might have client side software on your computer that could expose the data from your computer if you connect to compromised services.

In your case however, where you have a direct control over the OpenSSL client code (and I suppose this is the case based on your post), you have to ensure that your version of OpenSSL doesn't come with the Heartbeat option.

To see which options were used to compile your version of OpenSSL, use:

openssl version -o

And to compile OpenSSL without Heartbeat support, simply use this option when compiling :

-DOPENSSL_NO_HEARTBEATS

If this is done, or if your version of OpenSSL didn't include it initially, then you are not vulnerable.

added 335 characters in body
Source Link
ack__
  • 2.8k
  • 16
  • 25
Loading
Source Link
ack__
  • 2.8k
  • 16
  • 25
Loading