OpenSSL is an open-source implementation of the SSL and TLS protocols.
2
votes
1answer
28 views
Is the following code seeding OpenSSL's PRNG necessary, superfluous, or harmful?
As I was going through Crypt::SSLeay, preparing it for the next release, I noticed the following code, written way before my time,
...
int rand_bytes_read;
static int bNotFirstTime;
char buf[ 1024 ...
1
vote
0answers
19 views
Ruby OpenSSL vs Linux openssl
I have a difficulty reconciling Ruby's OpenSSL library with the standard Linux command line openssl.
What I'm trying to do here is encrypt the string mysecretstring with the password foobar but first ...
0
votes
0answers
68 views
OpenSSL: Bad Record MAC on TLS Heart Beat
I am trying to see the heartbleed bug in action with my OpenSSL server application.
My server uses the OpenSSL library - openssl-1.0.1b
I successfully connect with s_client (openssl-1.0.1b) to my ...
4
votes
1answer
145 views
What are the OpenSSL standard Diffie Hellmann parameters (primes)?
I recently generated some custom Diffie Hellmann parameters which are basically just long (in the below case 4096 bit) primes. Those are then used in the key exchange process.
I used the following ...
2
votes
7answers
113 views
How can I allow only authorized browsers to access a website?
I have a website and I want it to be accessible only by authorized clients/browsers (ex. with a certficate).
The idea is that the users can only access the webpage in their office's computers ...
1
vote
2answers
26 views
openssl aes 256 cbc strange bug
This is extremely strange but I have already tried this twice and am completely sure it is openSSL and not me doing the bug. I am encrypting the data 'Hygiene' with the password '*' (sorry can't tell ...
1
vote
1answer
69 views
OpenSSL Code Review
Is there to be a review in the code of OpenSSL any time in the near future? It seems OpenBSD is doing a controversial one, in that the review is also "Ripping out some windows-specific cruft". But is ...
2
votes
1answer
33 views
How to sign data with OpenSSL 0.9.8?
I am building a license generator for nodejs and I am currently testing on Heroku.
On my local machine running OpenSSL 1.0.1g, I'm able to test my key pairs (sign and verify) like this:
# data.txt's ...
2
votes
2answers
35 views
Would usage of jCryption 3.0 + SSL have mitigated the Heartbleed vulnerability?
I came across a project called jCryption 3.0, which encrypts data between the client and server, without using SSL. If a website's JavaScript had used jCryption 3.0 to encrypt login form fields before ...
2
votes
1answer
27 views
what are the current best practices for key generation
What is the difference between these openssl commands:
"openssl genrsa"
"openssl genpkey"
"openssl req -newkey rsa:bits [everything else]"
Which one should I be using when preparing a new CSR?
1
vote
1answer
34 views
Multi-tenancy and Heartbleed
We use a well-known service provider/API management gateway that sits in front of our RESTful APIs providing key management functionality etc. etc.
The service provider was running the dodgy OpenSSL ...
1
vote
2answers
86 views
SSL cert minimize downtime key rotation strategy
As you already know, due to the heartbleed bug, we need to perform re-keying on our web servers (>10), before I do that, I want to check if my proposed strategy is a proper way or not
a. Generate a ...
4
votes
2answers
225 views
Is crypto.js vulnerable to heartbleed attack? [duplicate]
We are using 'crypto.js' in our application.
Since 'crypto.js' uses open SSL ,are we vulnerable to heartbleeding attack?
If yes, what can we do to prevent it?
1
vote
1answer
339 views
Heartbleed detection [duplicate]
It is fairly easy to detect the heartbleed exploit if it all happens over cleartext, which it seems most things are doing for the time being. However, I believe that there are some heartbleed ...
57
votes
3answers
5k views
Heartbleed: Why does the client supply the length of the message at all?
"The fix for this bug is simple: check that the length of the message actually matches the length of the incoming request."
Why do we even have the client report the length at all?
If we can know ...
3
votes
2answers
142 views
Heartbleed and heap management - Why user data and passwords are kept in memory?
If I understand correctly the hearbleed vulnerability, only the heap of the OpenSSL process can be retrieved by an attacker (or part of depending on the memory allocation type that is used). Then, how ...
0
votes
3answers
90 views
When given a SSL-Private-Key, how would one generate a valid SSL-Cert from this? [duplicate]
in the hybris of leaked ssl-private-key everybody cries for new certs and new keys.
my question: how would one generate a new and valid ssl-cert with the private key from my website? our certs are ...
0
votes
1answer
67 views
Will the recently found OpenSSL vulnerablity Heartbleed affect my public site for which I obtained an SSL certificate from a CA? [duplicate]
I had generated the CSR with OpenSSL. Do I need to regenerate a new CSR with no vulnerability due to OpenSSL in order to obtain a new certificate from a CA?
5
votes
2answers
205 views
How secure is OpenSSH on FreeBSD?
In a discussion about the recent OpenSSL information disclosure vulnerability, the subject of OpenSSH being vulnerable came up. While OpenSSH is not vulnerable due to the problem lying in the TLS ...
-1
votes
0answers
23 views
Heartbleed & SSL Certificates - What do we do to protect ourselves as end users? [duplicate]
I seem to be hearing a lot of mixed opinions on this subject, so I figure I will turn to you guys for some advice.
From my understanding, we should consider any SSL certificate (generated by openssl) ...
0
votes
1answer
21 views
problem upgrading openssl on ubuntu servers [closed]
I'm running Ubuntu x86_64, and want to upgrade to OpenSSL 1.0.1.f.
wget <openssl latest>
tar -xzvf openssl.tar.gz
cd <openssl dir>
./configure --prefix=/usr
make
In the console output, ...
0
votes
0answers
13 views
How do I enable EVP functions in openssl? [migrated]
I am trying to update my webserver to the latest openssl with the heartbleed patch ( 1.0.1g ). Grabbed the tarball from openssl.org. Said the usual ./configure; make; make install.
Had to say ...
1
vote
1answer
345 views
How to verify OpenSSL's Heartbleed patch is the correct one?
In hearing about the Heartbleed vulnerability, I went to https://www.openssl.org/source/ to download the latest patch, but was quite surprised to find that the security certificate for that site has ...
-5
votes
1answer
93 views
Heartbleed “OpenSSL” extra clarification? [duplicate]
I Didn't get how this bug can be used against me !
the scenario need more explanation ,
User ------ Connected "OpenSSL" ------ Gmail
So , if a user in my network exploiting this bug against me , ...
2
votes
1answer
116 views
HeartBleed ReKeyed Cert with old creation date
the lastpass.com/heartbleed tool states that my server is most likely vulnerable and that users should wait untill my cert has been replaced.
It seems that they check for certificate creation date, ...
0
votes
2answers
215 views
How can I confirm that my server is protected against HeartBleed? [duplicate]
I just got a software update openssl-1.0.1e-37. I believe it is a patch for HeartBleed. Given that it was widely reported that versions up to 1.0.1f are vulnerable, how can I verify this patch on my ...
0
votes
0answers
15 views
Heartbleed - impact on iOS apps? [duplicate]
Just heard about the heartbleed news over the internet for OpenSSL and wondering if it affects ios apps as well. My app uses openssl crypto library and thus the concern !
Any views in this regard ...
0
votes
1answer
187 views
The Problem with Changing All Passwords for HeartBleed [duplicate]
One thing that's been bugging me in relation to the discovery of the Heartbleed OpenSSL flaw is the recommendation that everyone should run to their computers in a panic and change all of their ...
3
votes
3answers
832 views
Heartbleed - Read only the next 64k and hyping the threat
My understanding of the Heartbleed vulnerability is that there is no bounds check on the payload length/buffer size so the server can read into memory outside of its process space.
But can the start ...
0
votes
1answer
132 views
Doesn't the Heart Bleed vulnerability imply that we need to change passwords for *all* systems? [duplicate]
I understand the part about a server with the vulnerability.
But from what I gather, the vulnerability has also existed in browsers that use the vulnerable OpenSSL implementations.
So, if I first ...
5
votes
1answer
2k views
OpenSSL Heartbeat (Heartbleed bug) - what's the payload used for? [duplicate]
So the heartbeat bug can lead to memory read overrun, exposing (parts of) the process memory, because it reads the payload when there actually is no (or less) payload.
But what do you need a payload ...
187
votes
11answers
28k views
How to explain Heartbleed without technical terms?
Most of my friends who are not experienced in computers want to know what Heartbleed is and how it works. How would one explain Heartbleed to someone without a technical background?
0
votes
0answers
58 views
how to setup apache http server with the vulnerable openssl [migrated]
Actually I just want to do some test, so I want to setup an apache http server with the vulnerable (specifically with heartbleed bug) openssl, I'd better do it from source.
Does anyone know how to ...
5
votes
4answers
2k views
Heartbleed: OpenSSL v 0.9.8o and OpenVPN v 2.1.3 Reporting Vulnerable
According to the OpenSSL project the version in use on a server we control is not vulnerable: 0.9.8o. According to OpenVPN v 2.1.3 is also not vulnerable (also in use). These are running on Debian ...
10
votes
2answers
1k views
Does having 2-factor authentication help with HeartBleed?
I was talking with a friend about HeartBleed, and he mentioned that he had 2-factor authentication enabled on all the sites that supported it, so even with his username and passwords, nobody would be ...
8
votes
3answers
1k views
Do I need to worry about my SSH keys if my system was vulnerable to Heartbleed?
So I'm getting conflicting information from members of my team. The premise is, if an attacker can keep requesting 64 kb chunks of memory from my server, they could get the entire memory footprint of ...
2
votes
1answer
622 views
Heartbleed - Blown out of proportion? [duplicate]
From what I gather you need local memory based access correct to even access the private key? Is all this talk and worry of "Was I hacked?!" "Heartbleed just made you full hackable" ect... really over ...
1
vote
1answer
502 views
Heartbleed and Facebook logins on (once) vulnerable sites [duplicate]
Users have been advised to consult a list of sites affected by heartbleed and to change their passwords on those sites once they are no longer vulnerable. Facebook appears to have been unaffected; but ...
3
votes
0answers
159 views
Does heartbleed have any effect if OpenSSL was only used to generate the certificate [duplicate]
Edit: Please follow the above link to the original.
I have a self-signed certificate which is use to sign other certificates that I issued. This is all done with an affected version of OpenSSL. ...
1
vote
1answer
186 views
OpenSSL exploit [closed]
I have read about recent vulnerability in openssl. I tried to exploit one of my cloud servers where I run my web sites. I managed to get 64 KB of data. But what I managed to get was only HTML, CSS, ...
2
votes
1answer
165 views
Does the Heartbeat Openssl Bug also affect Servers who enforce Client Authentication?
Regarding the priority to upgrade servers, I want to confirm this, as I read in https://tools.ietf.org/html/rfc6520 chapter 3:
However, a HeartbeatRequest message SHOULD NOT be sent during
...
11
votes
3answers
7k views
How paranoid should the average user be about heartbleed? [duplicate]
Questions about Heartbleed have been showing up in the popular questions list today since morning, from the security stack exchange to android
I have been reading many of them, most of them are ...
1
vote
1answer
311 views
Is a mongodb build that uses the -ssl option vulnerable to heartbleed?
If one is using MongoDB enterprise, or built MongoDB from source using the -ssl option (as described here), is that MongoDB vulnerable to the heartbleed bug?
I know mongo needed openssl-devel to be ...
7
votes
1answer
2k views
Has Linux Mint updated the OpenSSL library for LMDE (Heartbleed bug)? [closed]
Background
I am using Linux Mint for one of my servers and have been trying to find out if the Linux Mint Debian Edition(LMDE) has updated their repositories with patches for the OpenSSL bug.
I ...
1
vote
1answer
7k views
How can I tell if a site is using open SSL, and which version? [duplicate]
In light of the Open SSL Heartbleed bug, I'd like to make sure I'm not putting any personal information in any system that is using Open SSL that is vulnerable.
So, from my browser (IE 11) how can I ...
6
votes
1answer
788 views
Does Heartbleed affect servers if OpenSSL was only used to generate the certificate?
I built an application that generates certificate signing requests (CSRs) using the PHP OpenSSL module.
Is there a way that the HeartBleed bug can affect these (in use) private keys and CSRs that ...
2
votes
1answer
260 views
Where/what is the actual HeartBleed bug? [duplicate]
I've read lots of reports of the HeartBleed bug but have not been able to find a description at the source-code level, such as this one for the goto fail bug. Can anyone provide, or point to, such an ...
4
votes
2answers
307 views
Are there any known Heartbleed attacks?
Are there any known instances of malicious security breeches exploiting the Heartbleed vulnerability? Or is there at present only a known vulnerability, albeit a very serious one?
1
vote
1answer
86 views
Does OpenSSL leave any traces that a server uses it?
I was thinking that maybe the banners can give some insight as to whether a server is using OpenSSL. Is there any tell tale signs that a server is using OpenSSL?
-- Clarification:
Speaking in terms ...
15
votes
5answers
4k views
Would the Heartbleed bug have been prevented if OpenSSL was written in Go/D/Vala?
IIUC the Heartbleed vulnerability happens due to a bug in the C source code of OpenSSL, by performing a memcpy() from a buffer that is too short. I'm wondering if the bug would have been prevented ...
