Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [heartbleed]

A highly critical vulnerability in the OpenSSL library which allows an attacker to obtain random 64kByte blocks of memory from the process using said library, which could include user credentials, private SSL keys, and other data sent/received from the server.

1
vote
1answer
125 views

What is the race condition in the Heartbleed attack?

A race condition occurs when two or more threads access shared data and try to do so at the same time. The Heartbleed attack is a vulnerability in OpenSSL, where a Client sends heartbeat requests to ...
3
votes
0answers
58 views

How can you influence what will be leaked by Heartbleed?

I am working on a Heartbleed example exploit. I was able to set the server up with an older version of Apache and OpenSSL and the server is infact vulnerable. However, when leaking the information, ...
1
vote
1answer
260 views

Nmap HeartBleed script does not seem to work over non-standard ports

The Nmap script for HeartBleed (using Nmap v7.40) seems to work only over known ports. Whenever a non-standard port is used, the script does not report anything. nmap -p 46000 --script ssl-heartbleed ...
3
votes
1answer
286 views

How CloudBleed is different from HeartBleed? [duplicate]

given the recent exposure of the information leak stemmed from buffer-overrun of HTML-parser of CF's edge servers; fundamentally how it is different from HeartBleed? CloudFlare have detailed the bug ...
0
votes
1answer
706 views

Help with creating Heartbleed vulnerable server

I am using Virtualbox internal network with Kali Linux and Ubuntu 12.04. The version of OpenSSL for the Ubuntu is 1.0.1 which should be vulnerable. I have created a HTTPS server using nginx on the ...
0
votes
1answer
74 views

Scrapping sensitive information via Heartbleed

What are the possibilities that someone will get sensitive information via the HeartBleed exploit ? As far as I can see, this exploit needs someone or something to "send" the exploit to the server, ...
1
vote
1answer
2k views

OpenSSL version 1.0.1e in CentOS 6 — Heartbleed Vulnerability

I was reading the Heartbleed vulnerability in the OpenSSL and in its official website, they have a list which mentioned that version 1.0.1 to 1.0.1f are affected, as shown in below pic. I have CentOS ...
123
votes
2answers
17k views

How is the Heartbleed exploit even possible?

I have read about the Heartbleed OpenSSL vulnerability and understand the concept. However what I don't understand is the part where we pass 64k as the length and the server returns 64kb of random ...
1
vote
0answers
41 views

What are the implications of Linux Mint still using OpenSSL 1.0.1f? [duplicate]

I'm currently using Linux Mint 17.3. Today I realized that the repos only provide the OpenSSL in version 1.0.1f. But only version >= 1.0.1g has the https://en.wikipedia.org/wiki/Heartbleed Bug ...
1
vote
1answer
448 views

Private key and wildcard certificates

I'm trying to understand the implications of private key leakage (due to Heartbleed) from a website that uses a wildcard certificate. If an organization has a wildcard certificate (valid for *.domain....
1
vote
2answers
254 views

Heartbleed POC: Is this sensitive information?

In order to demonstrate the Heartbleed problem, I executed a publicly available exploit against a vulnerable old NAS web-server that has since been replaced. Below is an excerpt from the subsequent ...
0
votes
1answer
106 views

Detecting heartbleed without sending a heartbeat packet (Heartbleed specific)

I am trying to detect if a server is vulnerable to heartbleed. To do this, only idea i have is to actually send a heartbeat packet having length field and actual payload having different length. But ...
0
votes
1answer
283 views

Event: ET SCAN Nmap NSE Heartbleed Request

Last night I got this incident on my siem tool: Event: ET SCAN Nmap NSE Heartbleed Request. Incident triggered from blacklisted IP to our open VPN server. Clicking on the signature content it ...
2
votes
1answer
263 views

Heartbleed RSA Key

I'm currently a student doing some research into the Heartbleed Vulnerability and I'm having difficulty retrieving the correct RSA private keys. Here is my setup environment in VirtualBox: Kali ...
5
votes
3answers
200 views

How to mitigate heartbleed like attacks prior to zero day

Whenever sensitive data such as a password is used on a server it resides in memory for a short time. Given that security flaws like heartbleed exist which have the ability to 'bleed' memory for their ...
2
votes
1answer
4k views

Why is this version of OpenSSL (1.0.1e) not vulnerable to Heartbleed?

I recently ran into a requirement that needed a web server set up with SSL, to show that its possible to extract the private key from a server with a vulnerable version of OpenSSL (Heartbleed). Hence, ...
7
votes
2answers
2k views

Are all SSL/TLS implementations vulnerable to the Heartbleed bug? [closed]

I've learned the theory behind the SSL/TLS protocols and how effective they are to achieve a secure communication between clients and servers. Do all the implementations OpenSSL, PolarSSL, MatrixSSL, ...
5
votes
1answer
244 views

How can Heartbleed checkers determine if a site is vulnerable?

As far as I know, there is not a way to obtain OpenSSL's version from a website. Then what kind of information does a Heartbleed checker obtain so it can determine if a site is safe from Heartbleed or ...
1
vote
1answer
268 views

How to check if Android application is vulnerable to heartbleed

I Am trying to find if an android application is vulnerable to heartbleed vulnerability. I want to know how to check if the application is vulnerable to heartbleed by reversing the app file.
2
votes
2answers
264 views

One year later, is Heartbleed still something the end-user needs to be careful against?

I'm running Chromebleed to defend against sites affected by Heartbleed, but it's been a very long time since I've used a site that was still vulnerable. By now I would think the vast majority of the ...
17
votes
4answers
51k views

Is TLS 1.0 more secure than TLS 1.2?

I just wanted to confirm, my system admin is telling me that TLS 1.0 is more secure than TLS 1.2 and told me I should stay on TLS 1.0...is this accurate? He mentioned that TLS 1.2 is more vulnerable ...
3
votes
1answer
254 views

Heartbleed: length of heatbeat message?

What is the right length of heartbeat message between 2^14 and 2^16 ? The RFC https://tools.ietf.org/html/rfc6520 says that The total length of a HeartbeatMessage MUST NOT exceed 2^14 or ...
-6
votes
1answer
624 views

Tls vs SSl heartbleed [closed]

I serched in the web for some more details and didn't find anything useful. May heartbleed attack be applied on the ssl protocol ? If not , why it hasnt the same security hole for heastbleed aa the ...
1
vote
1answer
59 views

Will changing the 'Action' for Heartbleed signatures in PAN from 'alert' to 'drop' have any production impact in my organization?

I have been seeing some Heart-bleed PAN alerts. I want to set the default action from 'alert' to 'drop'. But I am not sure if this would block some legitimate packets. Since there are a vast number ...
1
vote
2answers
449 views

Why is Un1c0rn exposing wget on heartbleed?

What's the point of spotlighting wget on heartbleed dumps? I'm specifically talking about this which is the first page of wget occurencies in heartbleed dumps. They put this page as a link on the ...
-6
votes
1answer
570 views

How does the Heartbleed exploit work? [duplicate]

I was wondering, what it means in the Heartbleed exploit. Let me explain. I'm trying to understand what does "hello" and "heartbeat" mean. Example: hello = h2bin("16 03 02 00 dc 01 00 00 d8 03 02 53 ...
2
votes
2answers
2k views

Is OpenSSL CCS Injection (CVE-2014-0224) critical?

Recently the CCS Injection was discovered in OpenSSL (CVE-2014-0224) http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0224. It allows man-in-the-middle attackers to consequently hijack sessions ...
1
vote
2answers
1k views

Heartbleed check for mobile and mobile apps

I have run a heartbleed detector from Lookout on my Android phone. It says: The version of openSSL is affected by the heartbleed bug but the vulnerable behaviour is not enabled. What does it ...
0
votes
2answers
305 views

Heartbleed: revoke or replace ssl certificate?

I have a free ssl certificate issued just before Heartbleed was found. Now my CA wants me to pay 25$ to revoke it. Should I pay or it's just enough to create a new certificate from another CA an ...
-3
votes
3answers
143 views

what is remedy for the heartbleed bug? [duplicate]

I found lot of articles describing about the heard bleed bug but can someone please explain the remedy for the heart bleed bug ?
1
vote
1answer
237 views

How to avoid Heartbleed like problems in the future?

I asked a question on stackoverflow, but guess this site is better suited for it. Idea is to prevent problems when the next buffer overflow bug comes out. In my understanding the problem with ...
0
votes
2answers
758 views

Is there a HeartBleed Honeypot so that I can pentest it? [closed]

I am looking to improve my skills, to do so I need a site with an old OpenSSL version, so that I can do a pentest on my own.
14
votes
2answers
2k views

Do any OpenBSD protections mitigate the damage from Heartbleed?

OpenBSD provides a list of substantial protections against exploits inherent to the OS. Most of these features are not found in other operating systems, or at least are not turned on by default. The ...
2
votes
1answer
339 views

Understanding Hearthbleed attacks [duplicate]

In order for a Heartbleed attack to happen and for someone to grab the SSL private key and even spy they have to be on the local network with a router, switch or server, correct? Or can this be done ...
-2
votes
1answer
66 views

Whether heartbleed is attaked while we are using heartbeat with apache(httpd)? [closed]

We are using heartbeat for high availability of httpd. In httpd we are using openssl of version 0.9.8 but about heartbeat i dont much about that but while search in google some sites are sayong that ...
0
votes
0answers
1k views

OpenSSL: Bad Record MAC on TLS Heart Beat

I am trying to see the heartbleed bug in action with my OpenSSL server application. My server uses the OpenSSL library - openssl-1.0.1b I successfully connect with s_client (openssl-1.0.1b) to my ...
5
votes
1answer
281 views

HeartBleed and Closed Source Hardware like Cisco

With the release of heartbleed how does one protect themselves with closed source networking hardware like cisco? Especially hardware with VPN variety. Would it be best to replaced such systems with ...
0
votes
1answer
676 views

Python SSH vs SSL? [duplicate]

I read the What is the difference between SSL vs SSH? Which is more secure? , and it mentions there is the possibility they can be affected by similar attacks. Now that the heartbleed thing is out, ...
4
votes
2answers
351 views

Can Heartbleed expose a TOR user's IP address?

It is interesting to observe, that TOR exit nodes with out-of-date OpenSSL implementations can themselves be affected by the Heartbleed bug. Can Heartbleed expose a TOR user's IP address merely by ...
2
votes
2answers
555 views

Would usage of jCryption 3.0 + SSL have mitigated the Heartbleed vulnerability?

I came across a project called jCryption 3.0, which encrypts data between the client and server, without using SSL. If a website's JavaScript had used jCryption 3.0 to encrypt login form fields before ...
0
votes
1answer
61 views

CNN Money Portfolio and Heartbleed [duplicate]

Is/was CNN Money Portfolio ever vulnerable to heartbleed? It states 256 bit SSL bank level encryption on the website..
8
votes
1answer
865 views

How can I verify if a website revoked its old SSL certificate keys? [duplicate]

Through reading from multiple sources and watching Security Now's How the Heartbleeds, I have come to the understanding that the following procedure is recommended to be safe from the Heartbleed ...
1
vote
1answer
3k views

Explain the Heartbleed Python code [closed]

first post here so be gentle please! I understand the Heartbleed vulnerability concept, and I have a general grasp of Python. I'm struggling to understand the PoC Python code though, so was after a ...
1
vote
3answers
153 views

Multi-tenancy and Heartbleed

We use a well-known service provider/API management gateway that sits in front of our RESTful APIs providing key management functionality etc. etc. The service provider was running the dodgy OpenSSL ...
1
vote
2answers
195 views

Testing your site for the heartbleed vulnerability? [duplicate]

I've seen a number of articles on the heartbleed vulnerability that suggest testing your site to see if it was affecting using Filippo Valsorda's testing page which can be found here: https://filippo....
2
votes
2answers
2k views

SSL cert minimize downtime key rotation strategy

As you already know, due to the heartbleed bug, we need to perform re-keying on our web servers (>10), before I do that, I want to check if my proposed strategy is a proper way or not a. Generate a ...
6
votes
2answers
1k views

Is crypto.js vulnerable to heartbleed attack? [duplicate]

We are using 'crypto.js' in our application. Since 'crypto.js' uses open SSL ,are we vulnerable to heartbleeding attack? If yes, what can we do to prevent it?
2
votes
2answers
2k views

What can a hacker do to my home router if I have the admin page enabled externally? [duplicate]

Say my home router uses an OpenSSL version that is vulnerable to Heartbleed and I have the admin page enabled and accessible from the outside (even though I never use it). What can a hacker do? ...
1
vote
1answer
498 views

Heartbleed detection [duplicate]

It is fairly easy to detect the heartbleed exploit if it all happens over cleartext, which it seems most things are doing for the time being. However, I believe that there are some heartbleed ...
9
votes
1answer
1k views

Who proposed adding heartbeat to SSL? And who proposed it's form?

So we now know who wrote the bad code (Robin Seggelmann). And we have an idea of why it is needed: Why does TLS need an explicit heartbeat protocol? We can also understand why the client supplies ...