4 ms·

What popular SSL client software uses the vulnerable OpenSSL? (Any web browsers, for example on popular linuxes? How about 'curl' when connecting to HTTPS sites

• gsnedders 13y ago
  Web browsers all by default use other crypto libraries. (Chromium can be linked to OpenSSL, some distros may ship this — I haven't looked.) Email clients may be more vulnerable — Thunderbird doesn't, Mail.app doesn't, but I'm unaware what most use.
  • hrrsn 13y ago
    Sidenote, OS X machines, by default, are not affected by this bug. $ openssl version -a OpenSSL 0.9.8y 5 Feb 2013
• sp332 13y ago
  How would a client be compromised? I mean I guess a malicious server could send these bad heartbeat packets and sniff the keys, but if the server is pwned then your secrets are already revealed, right?
  • gojomo 13y ago
    Imagine you've got a script that, among other things, does a 'wget' against some innocent plain HTTP URL. But an attacker intercepts your request, and redirects you to an HTTPS URL of their choosing. Yes, wget uses OpenSSL, and follows redirects silently by default. Now that server uses heartbleed to x-ray your client process memory, collecting all sorts of confidential information, including perhaps credentials to other services. This bug has a lot of nasty, unintuitive permutations and repercussions that will take time to fully grasp.