3 ms·
The bug also leaves the client vulnerable. Has anyone a link to test client implementations? (E.g Browsers,... Windows,... Android, Apps, etc)
by ce4 13y ago
The bug also leaves the client vulnerable.
Has anyone a link to test client implementations?
(E.g Browsers,... Windows,... Android, Apps, etc)
- agwa 13y agoThe vulnerability is in OpenSSL only, and no major browser uses OpenSSL. Firefox and Chromium use NSS, IE uses a Microsoft library, and Safari uses Apple's SecureTransport. Other OpenSSL-using clients are definitely vulnerable though - best bet to tell if you're vulnerable is to check the OpenSSL version.
- anonymfus 13y agoWhat about Opera 12, still major browser in CIS countries? OpenSSL license is listed on opera:about page, but version is not specified. How to find out?
- ce4 13y agoOpera 12 should be safe, as it doesn't support the heartbeat extension I tested it using openssl's s_server (with a quickly generated cert using tinyca) and then connecting to https://localhost:12345 https://localhost:12345 openssl s_server -accept 12345 -tlsextdebug -cert cert.pem | grep ^TLS TLS client extension "server name" (id=0), len=14 TLS client extension "renegotiation info" (id=65281), len=1 TLS client extension "status request" (id=5), len=5 TLS client extension "next protocol" (id=13172), len=0
- ce4 13y agoHere it is: https://reverseheartbleed.com/ https://reverseheartbleed.com/