Security vulnerability in OpenSSL allowing an attacker to obtain SSL keys, passwords, and other secure data from a server or client

learn more… | top users | synonyms

1
vote
1answer
24 views

HeartBleed and Client certificates

Is it true that a server, setup to require a client certificate, cannot suffer from the Heartbleed vulnerability, if that user does not have a client certificate?
1
vote
3answers
77 views

Compile Heartbleed.c Tester On CentOS 6.x

I have been looking for days now for a solution to this, basically I am trying to test my network for the heartbleed bug, but I am unable to compile the tester on CentOS 6.x, any ideas or suggestions ...
-1
votes
1answer
35 views

How can I secure Windows from heartbleed

I just fixed my openssl version on debianwheezy and updated my android device away from version 1.1.1 but the only thing that is missing is my windows-PC. My question now is, how is windows 7 ...
0
votes
0answers
21 views

Unix console steps to renew ssl keys

I have a ssl certificate for 3Yrs with 1.5Yrs expiry from today. Could anyone please provide the console steps to update the SSL certificate/regenerate the TLS cretificate for renewal with clear ...
6
votes
2answers
493 views

Heartbleed “Unexpected message”

I have a task to verify our company's software patch which addresses Heartbleed attack. Now, I am certain that version of software I am trying to exploit uses 1.0.1e OpenSSL library, which should be ...
1
vote
2answers
2k views

How to get the OpenSSL version in a Tomcat 6 installation

After reading an article about the Heartbleed security bug, I understand that it is good practice to check the OpenSSL version Apache Tomcat is using. The article contains this sentence: What ...
-1
votes
2answers
249 views

If man-in-the-middle attacks are rare, is Heartbleed as serious as suggested? [closed]

I connect to the internet on a secured wireless connection. I'm pretty sure nobody has MITM'd me on my LAN. How else could someone using Heartbleed to steal private keys access my data? I understand ...
0
votes
3answers
109 views

How do I know if a site is vulnerable to the Heartbleed bug?

So, I was thinking I should probably start changing my passwords after hearing all the talk about the Heartbleed bug. However, I then started thinking, what is the point of changing my password at a ...
3
votes
4answers
7k views

apt-get upgrade openssl won't bring Ubuntu 12.04 to latest version

I've tried the following, but I can't get a build date later than: Tue, Aug 21 05:18:46 UTC 2012 I have done the following: apt-get dist-upgrade apt-get update apt-get upgrade openssl and ...
0
votes
1answer
569 views

After the Heartbleed bug, do we need to update our OpenSSL DLL's?

Our software we develop uses the Indy internet component suite in Delphi. Indy has capabilities for OpenSSL. Since the Heartbleed incident, we're wondering if we need to take action. We distribute 2 ...
0
votes
1answer
131 views

Do I have to install Openssl 1.0.1g in usr/local/lib64 to overwrite usr/lib64 one? (CentOS 6.4, heartbleed issue)

I am using a VPS, I need to upgrade openssl with the new package in consequence of the heartbleed vulnerability issue. But I am a newbie in managing server, I need to know if I am getting this right ...
1
vote
2answers
91 views

Heartbleed threat: Do I need to change password for websites that I rarely logon?

I've a dozen email accounts, probably a hundred websites and forum accounts and I don't want to go about changing all the passwords. Do I need to change the password of websites that I seldom logon - ...
0
votes
2answers
99 views

heartbleed are CA private keys compromised?

have any CA private keys such as those used by godaddy to issue private/public key pairs compromised as a result of heartbleed?
1
vote
1answer
50 views

Does Heartbleed pose a risk for past HTTPS communications?

Heartbleed exposes a threat where computer memory for a vulnerable could be exposed. Consider an adversary with access to all cipher text input and output of your server (ISP, government, local ...
4
votes
2answers
360 views

How do I distinguish between these two certificate situations?

Situation 1 (safe): Website was vulnerable to heartbleed and using a certificate not valid before 2012-10-21 Website upgraded to an unvulnerable version of OpenSSL Website re-keyed and got a their ...
1
vote
3answers
497 views

How to setup Apache HTTP server with the vulnerable OpenSSL

I want to do some test, so I want to set up an Apache HTTP server with the vulnerable OpenSSL (specifically with the Heartbleed bug), and I'd better do it from source. How do I do that?
2
votes
1answer
135 views

Tool/Procedure to Evaluate Whether Each Site in a Password Manager (e.g., KeePass, LastPass, Dashlane) is ready for a new password (post Heartbleed)?

Sites need to be remediated for the Heartbleed exploit before a password is updated. Some sites will be remediated immediately but others may not be updated for months. Lots of us have many dozens ...
76
votes
11answers
10k views

What's an efficient way to change my 200+ account passwords?

I have a lot of online accounts, web services, and so on -- personal as well as business -- so obviously(?) I use a password manager to handle them all. Specifically I use Lastpass but my question ...
3
votes
1answer
3k views

Does Heartbleed Bug in OpenSSL affect ALL SSL certs

Does the Heartbleed Bug in OpenSSL affect ALL SSL certs, regardless of where I purchased or if I self-cert? For example, if I bought an SSL certificate from GoDaddy and set this up on my server ...
2
votes
1answer
2k views

Which versions of the Windows TLS/SSL file transfer software like WinSCP and FileZilla are not affected by Heartbleed?

I noticed that many people still use versions affected by the heartbleed vulnerability of wide spread TLS/SSL enabled Windows clients like WinSCP and Filezilla. To be able to make safe ...
112
votes
7answers
16k views

How to use the Internet while Heartbleed is being fixed?

There are many websites who are not currently vulnerable, but I have no idea if they were vulnerable a few days ago. For example: twitter.com: Not vulnerable right now, but the certificate is from ...
40
votes
2answers
21k views

Does Heartbleed affect ssh keys?

Does the recent Heartbleed bug affect the ssh keys I've generated and use to push/pull code with Github, Heroku, and other similar sites? Do I need to replace the keys I've been using?
10
votes
3answers
1k views

Do end users need to do anything about the Heartbleed security bug? What?

I see in the news about the “Heartbleed” security bug. As an end user, do I need to do anything about it?
9
votes
3answers
1k views

What should I do about the Heartbleed bug for the sites I run?

The recently announced Heartbleed bug in OpenSSL affects many sites (70% of the internet). There's a website: http://www.heartbleed.com There's a web-based test: http://filippo.io/Heartbleed/ ...
0
votes
0answers
128 views

Blocking a trusted certificate in Google Chrome

Is it possible to somehow block a certain certificate that is currently trusted by my browser? The reason is the recently discovered Heartbleed-attack which I also found out to affect my netbanking ...