OpenSSL 1.0.1 allows attackers to obtain sensitive information | Hacker News Reader

OpenSSL 1.0.1 allows attackers to obtain sensitive information

web.nvd.nist.gov

22 pointsarunc12 comments

It's kind of ironic that there are going to be NSA employees who are pissed that this got out. Here's a rewrite once the variable being the elephant in the room is plugged in:

"The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeart Extension packets, which allows the NSA to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c"

Here comes NIST to state the obvious, after the fact.

I already saw some OpenSSL lib patches coming in on Ubuntu 13.10, I guess I don't have to worry ?

Test tool: http://filippo.io/Heartbleed/ (not mine)

I have to say I'm wary of using this for any servers I control; what if they turn out to be vulnerable and this page is just collecting a list of machines to examine in detail later?

Has anyone found an offline tool for checking this?

Go to the repo[0], download the code, read the code, execute.

[0] https://github.com/FiloSottile/Heartbleed

Great, thank you. Just realised the repo is linked from the page too (I didn't stay long enough to spot it last time).

https://gist.github.com/sh1n0b1/10100394

find /usr/lib -name libssl* -print

Status of different versions:

OpenSSL 1.0.1 through 1.0.1f (inclusive) are vulnerable OpenSSL 1.0.1g is NOT vulnerable OpenSSL 1.0.0 branch is NOT vulnerable OpenSSL 0.9.8 branch is NOT vulnerable

Thanks, but I have already installed an updated package [0] that is supposed to fix it but doesn't bump the version number, so I'd like a direct check, just to quell my internal raving paranoid :)

[0] http://lists.centos.org/pipermail/centos-announce/2014-April...

https://news.ycombinator.com/item?id=7551489 https://github.com/titanous/heartbleeder

pikachu@BATTLEGYM ~/heartbleeder $ date

Tue Apr 8 05:43:57 PDT 2014

pikachu@BATTLEGYM ~/heartbleeder $ ./heartbleeder mail.yahoo.com

INSECURE - mail.yahoo.com:443 has the heartbeat extension enabled and is vulnerable

.....huh....I bet I know what security breach article I'll be reading in the next few days.

This test tool doesn't seem to work properly on servers using self-signed certificates.

Reply on news.ycombinator.com