-6

I serched in the web for some more details and didn't find anything useful. May heartbleed attack be applied on the ssl protocol ? If not , why it hasnt the same security hole for heastbleed aa the Tls has?

closed as unclear what you're asking by TildalWave, Mark, schroeder, Rory Alsop Jan 4 '15 at 18:01

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 3
    Neither SSL nor TLS are vulnerable to heartbleed; servers running unpatched versions of OpenSSL are vulnerable because they would leak information after receiving a specially crafted packet. The question of SSL vs. TLS is irrelevant. – tlng05 Jan 3 '15 at 21:46
  • but why I cant say thay TLS is vulnerable if the openSSL library it is implemented with is vulnerable? – Yakov Mor Jan 4 '15 at 5:13
  • 1
    Think about it this way: SSL/TLS describes the math that needs to be done; openSSL is just a piece of software that performs that math. It just so happens that the people behind openSSL made a programming error that allows it to sometimes leak data - aka heartbleed. The math is and always was still sound, but one particular piece of software written to perform that math was flawed. There was never a fundamental problem with the math, so it can't be considered a flaw in SSL or TLS. – tlng05 Jan 4 '15 at 6:15
2

Heartbleed isn't a flaw in a protocol, it's a flaw in the OpenSSL implementation of that protocol on the server side. SSL/TLS version is irrelevant, because it's not against the protocol (nor is it against individual client connections, so if it were a protocol flaw, it would only matter what the server supports, not what's being used on an individual connection).

Also, SSL and TLS are the same thing. SSL was the name up through version 3, then they renamed it to TLS and reset the version to 1 for the next protocol version (when the IETF took over). There's no fundamental difference, TLS is just the newer versions (differences between SSL versions and TLS versions aren't really more than between TLS versions).

  • 1
    Newer versions, yes, but different enough in their implementation to be treated and named differently. SSL is completely obsolete now because of the POODLE exploit, so anything less than TLS v1.1 should be disabled. – Craig Jan 3 '15 at 21:48
  • But POODLE also affects TLS 1.0, and other vulnerabilities affected SSL 2 but not 3. From everything I can see, TLS 1.0 is effectively SSL 3.1, and was renamed when IETF took over development from Netscape. The rename was not for technical reasons, it was for political ones. – cpast Jan 3 '15 at 21:58
  • Yeah, that's pretty much true that SSL 3.x is TLS 1.0. But it is not TLS 1.1. (upvoted your answer, by the way) ;-) – Craig Jan 3 '15 at 22:01
  • Edited to hopefully clarify (Individual versions are different, but the name change wasn't associated with an especially significant change). – cpast Jan 3 '15 at 22:13
  • so why they changed the name? just to confuse? – Yakov Mor Jan 4 '15 at 5:12

Not the answer you're looking for? Browse other questions tagged or ask your own question.