Re: Heartbleed bug?

From	Arno Welzel <usenet@arnowelzel.de>
Newsgroups	comp.lang.php
Subject	Re: Heartbleed bug?
Date	2014-04-11 08:23 +0200
Message-ID	<53478A48.6020905@arnowelzel.de> (permalink)
References	(1 earlier) <53463D84.5090007@arnowelzel.de> <534640F2.3010009@arnowelzel.de> <li6ejn$pe5$3@dont-email.me> <53470582.1020407@arnowelzel.de> <li78jv$6qp$3@dont-email.me>

Show all headers | View raw

Denis McMahon, 2014-04-11 01:14:

> On Thu, 10 Apr 2014 22:56:34 +0200, Arno Welzel wrote:
> 
>> Denis McMahon, 2014-04-10 17:50:
>>
>>> On Thu, 10 Apr 2014 08:57:54 +0200, Arno Welzel wrote:
>>>
>>>> To be precise: If the installed PHP version is linked against OpenSSL
>>>> then it should be replaced with a patched version of course.
>>>
>>> Is simply being linked against the buggy openssl enough to be
>>> exploitable? As I understand it the openssl code needs to be invoked
>>> (eg
>>
>> No. The bug is only exploitable if you run a SSL/TLS server - which is
>> possible using PHP.
>>
>>> https) for the bug to actually expose data.
> 
> Sorry, but you seem to be saying "No" and then agreeing with me. Perhaps 
> it's the way you have quote-replied, and I'm reading your "No" as 
> applying to a different part of the quoted text to that which you 
> intended it to refer?

Sorry for the confusion :-(

> Are you saying "No" to the question:
> 
>>> Is simply being linked against the buggy openssl enough to be
>>> exploitable? 

Yes - this I am referring to. Just the fact that you use a PHP version
which is linket to a buggy OpenSSL lib is of course not enough to
exploit the bug. One has to actually *use* the buggy functions in a way
that an attacker can send crafted heartbeat packets to your server.



-- 
Arno Welzel
http://arnowelzel.de
http://de-rec-fahrrad.de
http://fahrradzukunft.de

Thread

Heartbleed bug? Kevin Burton <ronald.kevin.burton@gmail.com> - 2014-04-09 05:24 -0700
  Re: Heartbleed bug? Jerry Stuckle <jstucklex@attglobal.net> - 2014-04-09 09:17 -0400
    Re: Heartbleed bug? Robert Heller <heller@deepsoft.com> - 2014-04-09 08:56 -0500
      Re: Heartbleed bug? Jerry Stuckle <jstucklex@attglobal.net> - 2014-04-09 11:21 -0400
        Re: Heartbleed bug? Christoph Michael Becker <cmbecker69@arcor.de> - 2014-04-09 17:43 +0200
          Re: Heartbleed bug? Jerry Stuckle <jstucklex@attglobal.net> - 2014-04-09 13:37 -0400
            Re: Heartbleed bug? Arno Welzel <usenet@arnowelzel.de> - 2014-04-10 08:51 +0200
              Re: Heartbleed bug? Jerry Stuckle <jstucklex@attglobal.net> - 2014-04-10 07:52 -0400
                Re: Heartbleed bug? Christoph Michael Becker <cmbecker69@arcor.de> - 2014-04-10 14:03 +0200
                Re: Heartbleed bug? Jerry Stuckle <jstucklex@attglobal.net> - 2014-04-10 12:36 -0400
                Re: Heartbleed bug? Denis McMahon <denismfmcmahon@gmail.com> - 2014-04-10 23:01 +0000
                Re: Heartbleed bug? The Natural Philosopher <tnp@invalid.invalid> - 2014-04-11 00:47 +0100
                Re: Heartbleed bug? Eli the Bearded <*@eli.users.panix.com> - 2014-04-11 00:38 +0000
                Re: Heartbleed bug? Jerry Stuckle <jstucklex@attglobal.net> - 2014-04-10 21:58 -0400
                Re: Heartbleed bug? Denis McMahon <denismfmcmahon@gmail.com> - 2014-04-11 02:59 +0000
                Re: Heartbleed bug? The Natural Philosopher <tnp@invalid.invalid> - 2014-04-11 04:36 +0100
                Re: Heartbleed bug? Jerry Stuckle <jstucklex@attglobal.net> - 2014-04-11 12:08 -0400
                Re: Heartbleed bug? Arno Welzel <usenet@arnowelzel.de> - 2014-04-10 22:54 +0200
                Re: Heartbleed bug? Denis McMahon <denismfmcmahon@gmail.com> - 2014-04-10 22:45 +0000
                Re: Heartbleed bug? Arno Welzel <usenet@arnowelzel.de> - 2014-04-11 08:33 +0200
              Re: Heartbleed bug? Denis McMahon <denismfmcmahon@gmail.com> - 2014-04-10 15:47 +0000
        Re: Heartbleed bug? Robert Heller <heller@deepsoft.com> - 2014-04-09 10:56 -0500
          Re: Heartbleed bug? Jerry Stuckle <jstucklex@attglobal.net> - 2014-04-09 13:38 -0400
            Re: Heartbleed bug? "M. Strobel" <sorry_no_mail_here@nowhere.dee> - 2014-04-10 00:11 +0200
              Re: Heartbleed bug? Jerry Stuckle <jstucklex@attglobal.net> - 2014-04-10 07:53 -0400
          Re: Heartbleed bug? The Natural Philosopher <tnp@invalid.invalid> - 2014-04-09 21:02 +0100
  Re: Heartbleed bug? Adam Harvey <usenet@adamharvey.name> - 2014-04-09 23:43 +0000
    Re: Heartbleed bug? Eli the Bearded <*@eli.users.panix.com> - 2014-04-10 00:01 +0000
  Re: Heartbleed bug? Arno Welzel <usenet@arnowelzel.de> - 2014-04-10 08:43 +0200
    Re: Heartbleed bug? Arno Welzel <usenet@arnowelzel.de> - 2014-04-10 08:57 +0200
      Re: Heartbleed bug? Denis McMahon <denismfmcmahon@gmail.com> - 2014-04-10 15:50 +0000
        Re: Heartbleed bug? The Natural Philosopher <tnp@invalid.invalid> - 2014-04-10 19:37 +0100
        Re: Heartbleed bug? Arno Welzel <usenet@arnowelzel.de> - 2014-04-10 22:56 +0200
          Re: Heartbleed bug? "M. Strobel" <sorry_no_mail_here@nowhere.dee> - 2014-04-10 23:32 +0200
          Re: Heartbleed bug? Denis McMahon <denismfmcmahon@gmail.com> - 2014-04-10 23:14 +0000
            Re: Heartbleed bug? Arno Welzel <usenet@arnowelzel.de> - 2014-04-11 08:23 +0200
  Re: Heartbleed bug? Denis McMahon <denismfmcmahon@gmail.com> - 2014-04-10 15:42 +0000
    Re: Heartbleed bug? Arno Welzel <usenet@arnowelzel.de> - 2014-04-11 13:00 +0200

csiph-web