5

As far as I know, there is not a way to obtain OpenSSL's version from a website. Then what kind of information does a Heartbleed checker obtain so it can determine if a site is safe from Heartbleed or not?

  • 2
    @begueradj: I'm not sure this is a duplicate (related yes, but not duplicate). I have the impression that the OP already knows about Hearbleed vulnerability checkers, the question seems merely here to understand how do this checkers work since the OpenSSL version is not available remotely (no version banner for instance). – WhiteWinterWolf Aug 15 '15 at 10:25
  • yes that's what i asked for . – Prometheus Aug 15 '15 at 17:19
10

The Heartbleed bug involves asking the server to return a block of memory that is larger than the actual information being returned. A vulnerable server will return whatever is in memory beyond the data structure it's returning. So, if you ask a server to return the extra memory and it does, then the server is vulnerable.

You can examine the code diffs for the patch here. There's a lot of duplication in the code but the basic change is to add this:

if (1 + 2 + payload + 16 > s->s3->rrec.length)
    return 0; /* silently discard */

So you can see how it now fails if you request a buffer larger than the actual size.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.