0

I have a Windows based server that serves a signed JAVA applet. The website isn't secured (HTTP), but all JAVA applets have to be signed now, so the site serves a signed JAVA applet as part of a web page. As such, the applet would have access to the client computer.

I can't explicitly find OpenSSL anywhere on the server, but I'm unclear if Apache (on Windows) somehow has it built in, and if the applet is vulnerable to this exploit.

closed as unclear what you're asking by AviD Apr 10 '14 at 14:59

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

1

I like keeping this simple.

If the webserver runs OpenSSL 1.0.1 through 1.0.1f and accepts SSL connections, it will most likely be vulnerable. As Steven says, this is SSL/TLS protocol wich is transport layer security.

This exploit is not on the application layer of the OSI layer.

Have a look at heartbleed.com for detailed information about the exploit.

  • I've read the details on heartbleed.com. It still wasn't clear whether my server is vulnerable - hence my question here. According to [this article] (theregister.co.uk/2014/04/10/…), the server could just have non-port-443 software that was compiled against the bug, and be vulnerable. – Gerrat Apr 10 '14 at 14:28
  • If it doesnt use the entire OpenSSL lib, it is possible that it isnt vulnerable. Grab a clone of gist.github.com/takeshixx/10107280 And test it against your application/server is my best advice – Neophyte Apr 10 '14 at 14:31
0

If you're hosting the web site in Internet Information Services (IIS), you won't be affected because IIS doesn't use OpenSSL to support the SSL/TLS protocol. See Vulnerability Note VU#720951 for reference.

Not sure what SSL/TLS implementation Apache for Windows uses, though. Chances are it does use OpenSSL, in which case you'll want to apply a security patch as soon as possible.

Not the answer you're looking for? Browse other questions tagged or ask your own question.