0

I have a Windows based server that serves a signed JAVA applet. The website isn't secured (HTTP), but all JAVA applets have to be signed now, so the site serves a signed JAVA applet as part of a web page. As such, the applet would have access to the client computer.

I can't explicitly find OpenSSL anywhere on the server, but I'm unclear if Apache (on Windows) somehow has it built in, and if the applet is vulnerable to this exploit.

1

I like keeping this simple.

If the webserver runs OpenSSL 1.0.1 through 1.0.1f and accepts SSL connections, it will most likely be vulnerable. As Steven says, this is SSL/TLS protocol wich is transport layer security.

This exploit is not on the application layer of the OSI layer.

Have a look at heartbleed.com for detailed information about the exploit.

  • I've read the details on heartbleed.com. It still wasn't clear whether my server is vulnerable - hence my question here. According to [this article] (theregister.co.uk/2014/04/10/…), the server could just have non-port-443 software that was compiled against the bug, and be vulnerable. – Gerrat Apr 10 '14 at 14:28
  • If it doesnt use the entire OpenSSL lib, it is possible that it isnt vulnerable. Grab a clone of gist.github.com/takeshixx/10107280 And test it against your application/server is my best advice – Neophyte Apr 10 '14 at 14:31
0

If you're hosting the web site in Internet Information Services (IIS), you won't be affected because IIS doesn't use OpenSSL to support the SSL/TLS protocol. See Vulnerability Note VU#720951 for reference.

Not sure what SSL/TLS implementation Apache for Windows uses, though. Chances are it does use OpenSSL, in which case you'll want to apply a security patch as soon as possible.

Not the answer you're looking for? Browse other questions tagged or ask your own question.