3 ms·
"able to steal the SSL certificate, to be sure, and also able to intercept other HTTPS connections" Couldn't a SSL-terminating process that's vulnerable to hea
by tlrobinson 13y ago
"able to steal the SSL certificate, to be sure, and also able to intercept other HTTPS connections"
Couldn't a SSL-terminating process that's vulnerable to heartbleed also leak unencrypted traffic? The attacker wouldn't even need to be in a position to intercept other users' connections, which is much worse.
I don't know about stunnel specifically though, maybe it doesn't free memory containing unencrypted traffic.
- mbq 13y agoThe worse problem is that once you get the private key you can MITM the traffic or, if forward security was not used, decrypt a sniffed one -- this will limit the casual attacker to a directed attacks, though.