4 ms·
OpenSSL 1.0.1 allows attackers to obtain sensitive information
- deleted 13y ago[deleted]
- higherpurpose 13y agoHere comes NIST to state the obvious, after the fact.
- easy_rider 13y agoI already saw some OpenSSL lib patches coming in on Ubuntu 13.10, I guess I don't have to worry ?
- deleted 13y ago[deleted]
- somesay 13y agoTest tool: http://filippo.io/Heartbleed/ http://filippo.io/Heartbleed/ (not mine)
- Obscure 13y agoI have to say I'm wary of using this for any servers I control; what if they turn out to be vulnerable and this page is just collecting a list of machines to examine in detail later? Has anyone found an offline tool for checking this?
- smtddr 13y agohttps://news.ycombinator.com/item?id=7551489 https://news.ycombinator.com/item?id=7551489 https://github.com/titanous/heartbleeder https://github.com/titanous/heartbleeder pikachu@BATTLEGYM ~/heartbleeder $ date Tue Apr 8 05:43:57 PDT 2014 pikachu@BATTLEGYM ~/heartbleeder $ ./heartbleeder mail.yahoo.com INSECURE - mail.yahoo.com:443 has the heartbeat extension enabled and is vulnerable .....huh....I bet I know what security breach article I'll be reading in the next few days.
- sepeth 13y agohttps://gist.github.com/sh1n0b1/10100394 https://gist.github.com/sh1n0b1/10100394
- ushi 13y agoGo to the repo[0], download the code, read the code, execute. [0] https://github.com/FiloSottile/Heartbleed https://github.com/FiloSottile/Heartbleed
- Obscure 13y agoGreat, thank you. Just realised the repo is linked from the page too (I didn't stay long enough to spot it last time).
- solarexplorer 13y agofind /usr/lib -name libssl* -print Status of different versions: OpenSSL 1.0.1 through 1.0.1f (inclusive) are vulnerable OpenSSL 1.0.1g is NOT vulnerable OpenSSL 1.0.0 branch is NOT vulnerable OpenSSL 0.9.8 branch is NOT vulnerable
- Obscure 13y agoThanks, but I have already installed an updated package [0] that is supposed to fix it but doesn't bump the version number, so I'd like a direct check, just to quell my internal raving paranoid :) [0] http://lists.centos.org/pipermail/centos-announce/2014-April/020249.html http://lists.centos.org/pipermail/centos-announce/2014-April...
- oakwhiz 13y agoThis test tool doesn't seem to work properly on servers using self-signed certificates.
- hadoukenio 13y agoIt's kind of ironic that there are going to be NSA employees who are pissed that this got out. Here's a rewrite once the variable being the elephant in the room is plugged in: "The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeart Extension packets, which allows the NSA to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c"