Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > comp.sys.mac.system > #58446
| Path | csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!nntp.club.cc.cmu.edu!micro-heart-of-gold.mit.edu!bloom-beacon.mit.edu!bloom-beacon.mit.edu!panix!MIX!Blackbird |
|---|---|
| From | billy@MIX.COM |
| Newsgroups | comp.sys.mac.system |
| Subject | Re: BHeartbleed OpenSSL vulnerability |
| Date | Thu, 10 Apr 2014 06:08:45 +0000 (UTC) |
| Organization | PANIX Public Access Internet and UNIX, NYC |
| Lines | 24 |
| Message-ID | <li5chd$88c$1@reader2.panix.com> (permalink) |
| References | <534459ac$0$35014$c3e8da3$460562f1@news.astraweb.com> <li1sjh$i7t$1@reader2.panix.com> <slrnlk92va.2gta.timmcn@sugaree.local> <53448d99$0$1553$c3e8da3$40cdd511@news.astraweb.com> |
| NNTP-Posting-Host | panix5.panix.com |
| X-Trace | reader2.panix.com 1397110125 8460 166.84.1.5 (10 Apr 2014 06:08:45 GMT) |
| X-Complaints-To | abuse@panix.com |
| NNTP-Posting-Date | Thu, 10 Apr 2014 06:08:45 +0000 (UTC) |
| Xref | csiph.com comp.sys.mac.system:58446 |
Show key headers only | View raw
Joanna Shuttleworth <js@example.com> writes:
> and, yes, the client version can leak stuff under some circumstances...
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140409-heartbleed
| The vulnerability is due to a missing bounds check in the handling of
| the Transport Layer Security (TLS) heartbeat extension. An attacker
| could exploit this vulnerability by implementing a malicious TLS or
| Datagram Transport Layer Security (DTLS) client, if trying to exploit
| the vulnerability on an affected server, or a malicious TLS or DTLS
| server, if trying to exploit the vulnerability on an affected client.
| An exploit could send a specially crafted TLS or DTLS heartbeat packet
| to the connected client or server. An exploit could allow the attacker
| to disclose a limited portion of memory from a connected client or
| server for every heartbeat packet sent. The disclosed portions of
| memory could contain sensitive information that may include private
| keys and passwords.
Billy Y..
--
sub #'9+1 ,r0 ; convert ascii byte
add #9.+1 ,r0 ; to an integer
bcc 20$ ; not a number
Back to comp.sys.mac.system | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
BHeartbleed OpenSSL vulnerability JF Mezei <jfmezei.spamnot@vaxination.ca> - 2014-04-08 16:18 -0400
Re: BHeartbleed OpenSSL vulnerability Jolly Roger <jollyroger@pobox.com> - 2014-04-08 20:26 +0000
Re: BHeartbleed OpenSSL vulnerability JF Mezei <jfmezei.spamnot@vaxination.ca> - 2014-04-08 16:27 -0400
Re: BHeartbleed OpenSSL vulnerability billy@MIX.COM - 2014-04-08 22:18 +0000
Re: BHeartbleed OpenSSL vulnerability Tim McNamara <timmcn@bitstream.net> - 2014-04-08 18:53 -0500
Re: BHeartbleed OpenSSL vulnerability Joanna Shuttleworth <js@example.com> - 2014-04-09 00:00 +0000
Re: BHeartbleed OpenSSL vulnerability Tim McNamara <timmcn@bitstream.net> - 2014-04-08 23:20 -0500
Re: BHeartbleed OpenSSL vulnerability David Ritz <dritz@mindspring.com> - 2014-04-09 07:56 -0500
Re: BHeartbleed OpenSSL vulnerability billy@MIX.COM - 2014-04-10 06:08 +0000
Re: BHeartbleed OpenSSL vulnerability Jolly Roger <jollyroger@pobox.com> - 2014-04-09 00:50 +0000
Re: BHeartbleed OpenSSL vulnerability Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-04-16 13:18 +0000
csiph-web