Linked Questions

0
votes
2answers
605 views

How can I confirm that my server is protected against HeartBleed? [duplicate]

I just got a software update openssl-1.0.1e-37. I believe it is a patch for HeartBleed. Given that it was widely reported that versions up to 1.0.1f are vulnerable, how can I verify this patch on my ...
1
vote
2answers
198 views

Testing your site for the heartbleed vulnerability? [duplicate]

I've seen a number of articles on the heartbleed vulnerability that suggest testing your site to see if it was affecting using Filippo Valsorda's testing page which can be found here: https://filippo....
-3
votes
3answers
147 views

what is remedy for the heartbleed bug? [duplicate]

I found lot of articles describing about the heard bleed bug but can someone please explain the remedy for the heart bleed bug ?
0
votes
1answer
96 views

Will the recently found OpenSSL vulnerability Heartbleed affect my public site for which I obtained an SSL certificate from a CA? [duplicate]

I had generated the CSR with OpenSSL. Do I need to regenerate a new CSR with no vulnerability due to OpenSSL in order to obtain a new certificate from a CA?
255
votes
11answers
37k views

How to explain Heartbleed without technical terms?

Most of my friends who are not experienced in computers want to know what Heartbleed is and how it works. How would one explain Heartbleed to someone without a technical background?
224
votes
1answer
88k views

How exactly does the OpenSSL TLS heartbeat (Heartbleed) exploit work?

I've been hearing more about the OpenSSL Heartbleed attack, which exploits some flaw in the heartbeat step of TLS. If you haven't heard of it, it allows people to: Steal OpenSSL private keys Steal ...
28
votes
6answers
18k views

Heartbleed and Routers/ASAs/other

OK, so I first heard about heartbleed a few hours ago through the stack exchange questions feed, and after a moments panic, realised that the only web servers I have secured via OpenSSL are on the ...
57
votes
2answers
7k views

What should end-users do about Heartbleed?

What should a website operator do about the Heartbleed OpenSSL exploit? mainly talks about what people running websites should do about Heartbleed. What should end-users of websites be doing? Do ...
27
votes
2answers
7k views

Guidance for implementors of HTTPS-only sites (Server side)

The recent trend in HTTPS attacks is to attack the HTTP protocol. What should I do to increase my site's security if the only protocol I want is HTTPS? Some easy to implement ideas are Implement ...
2
votes
1answer
2k views

HeartBleed - how do I invalidate all session cookies?

As part of the Heartbleed event, I have upgraded OpenSSL, reissued and replaced certificates and revoked the old ones and changed passwords however, I am also seeing advice to invalidate all session ...
10
votes
1answer
1k views

Heartbleed how to find out applications using statically compiled version of openssl?

We're analysing issue at work and I wondering how to find out if there's any binary with a statically compiled version of openssl which includes this bug. Would it be possible to find a fingerprint ...
1
vote
1answer
293 views

OpenSSL exploit [closed]

I have read about recent vulnerability in openssl. I tried to exploit one of my cloud servers where I run my web sites. I managed to get 64 KB of data. But what I managed to get was only HTML, CSS, ...