Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > comp.sys.mac.system > #58446
| From | billy@MIX.COM |
|---|---|
| Newsgroups | comp.sys.mac.system |
| Subject | Re: BHeartbleed OpenSSL vulnerability |
| Date | 2014-04-10 06:08 +0000 |
| Organization | PANIX Public Access Internet and UNIX, NYC |
| Message-ID | <li5chd$88c$1@reader2.panix.com> (permalink) |
| References | <534459ac$0$35014$c3e8da3$460562f1@news.astraweb.com> <li1sjh$i7t$1@reader2.panix.com> <slrnlk92va.2gta.timmcn@sugaree.local> <53448d99$0$1553$c3e8da3$40cdd511@news.astraweb.com> |
Joanna Shuttleworth <js@example.com> writes:
> and, yes, the client version can leak stuff under some circumstances...
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140409-heartbleed
| The vulnerability is due to a missing bounds check in the handling of
| the Transport Layer Security (TLS) heartbeat extension. An attacker
| could exploit this vulnerability by implementing a malicious TLS or
| Datagram Transport Layer Security (DTLS) client, if trying to exploit
| the vulnerability on an affected server, or a malicious TLS or DTLS
| server, if trying to exploit the vulnerability on an affected client.
| An exploit could send a specially crafted TLS or DTLS heartbeat packet
| to the connected client or server. An exploit could allow the attacker
| to disclose a limited portion of memory from a connected client or
| server for every heartbeat packet sent. The disclosed portions of
| memory could contain sensitive information that may include private
| keys and passwords.
Billy Y..
--
sub #'9+1 ,r0 ; convert ascii byte
add #9.+1 ,r0 ; to an integer
bcc 20$ ; not a number
Back to comp.sys.mac.system | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
BHeartbleed OpenSSL vulnerability JF Mezei <jfmezei.spamnot@vaxination.ca> - 2014-04-08 16:18 -0400
Re: BHeartbleed OpenSSL vulnerability Jolly Roger <jollyroger@pobox.com> - 2014-04-08 20:26 +0000
Re: BHeartbleed OpenSSL vulnerability JF Mezei <jfmezei.spamnot@vaxination.ca> - 2014-04-08 16:27 -0400
Re: BHeartbleed OpenSSL vulnerability billy@MIX.COM - 2014-04-08 22:18 +0000
Re: BHeartbleed OpenSSL vulnerability Tim McNamara <timmcn@bitstream.net> - 2014-04-08 18:53 -0500
Re: BHeartbleed OpenSSL vulnerability Joanna Shuttleworth <js@example.com> - 2014-04-09 00:00 +0000
Re: BHeartbleed OpenSSL vulnerability Tim McNamara <timmcn@bitstream.net> - 2014-04-08 23:20 -0500
Re: BHeartbleed OpenSSL vulnerability David Ritz <dritz@mindspring.com> - 2014-04-09 07:56 -0500
Re: BHeartbleed OpenSSL vulnerability billy@MIX.COM - 2014-04-10 06:08 +0000
Re: BHeartbleed OpenSSL vulnerability Jolly Roger <jollyroger@pobox.com> - 2014-04-09 00:50 +0000
Re: BHeartbleed OpenSSL vulnerability Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-04-16 13:18 +0000
csiph-web