Questions tagged [heartbleed]
Security vulnerability in OpenSSL allowing an attacker to obtain SSL keys, passwords, and other secure data from a server or client
24
questions
1
vote
1
answer
71
views
HeartBleed and Client certificates
Is it true that a server, setup to require a client certificate, cannot suffer from the Heartbleed vulnerability, if that user does not have a client certificate?
- 11
1
vote
3
answers
651
views
Compile Heartbleed.c Tester On CentOS 6.x
I have been looking for days now for a solution to this, basically I am trying to test my network for the heartbleed bug, but I am unable to compile the tester on CentOS 6.x, any ideas or suggestions ...
-1
votes
1
answer
46
views
How can I secure Windows from heartbleed
I just fixed my openssl version on debianwheezy and updated my android device away from version 1.1.1 but the only thing that is missing is my windows-PC. My question now is, how is windows 7 ...
- 21
6
votes
2
answers
2k
views
Heartbleed "Unexpected message"
I have a task to verify our company's software patch which addresses Heartbleed attack.
Now, I am certain that version of software I am trying to exploit uses 1.0.1e OpenSSL library, which should be ...
1
vote
2
answers
19k
views
How to get the OpenSSL version in a Tomcat 6 installation
After reading an article about the Heartbleed security bug, I understand that it is good practice to check the OpenSSL version Apache Tomcat is using.
The article contains this sentence:
What ...
- 133
-1
votes
2
answers
322
views
If man-in-the-middle attacks are rare, is Heartbleed as serious as suggested? [closed]
I connect to the internet on a secured wireless connection. I'm pretty sure nobody has MITM'd me on my LAN. How else could someone using Heartbleed to steal private keys access my data? I understand ...
- 1
0
votes
3
answers
129
views
How do I know if a site is vulnerable to the Heartbleed bug?
So, I was thinking I should probably start changing my passwords after hearing all the talk about the Heartbleed bug. However, I then started thinking, what is the point of changing my password at a ...
- 298
6
votes
4
answers
21k
views
apt-get upgrade openssl won't bring Ubuntu 12.04 to latest version
I've tried the following, but I can't get a build date later than:
Tue, Aug 21 05:18:46 UTC 2012
I have done the following:
apt-get dist-upgrade
apt-get update
apt-get upgrade openssl
and
apt-get ...
- 162
0
votes
1
answer
1k
views
After the Heartbleed bug, do we need to update our OpenSSL DLL's?
Our software we develop uses the Indy internet component suite in Delphi. Indy has capabilities for OpenSSL. Since the Heartbleed incident, we're wondering if we need to take action.
We distribute 2 ...
- 373
0
votes
1
answer
429
views
Do I have to install Openssl 1.0.1g in usr/local/lib64 to overwrite usr/lib64 one? (CentOS 6.4, heartbleed issue)
I am using a VPS, I need to upgrade openssl with the new package in consequence of the heartbleed vulnerability issue.
But I am a newbie in managing server, I need to know if I am getting this right :...
- 115
1
vote
2
answers
103
views
Heartbleed threat: Do I need to change password for websites that I rarely logon?
I've a dozen email accounts, probably a hundred websites and forum accounts and I don't want to go about changing all the passwords.
Do I need to change the password of websites that I seldom logon - ...
- 261
0
votes
2
answers
151
views
heartbleed are CA private keys compromised?
have any CA private keys such as those used by godaddy to issue private/public key pairs compromised as a result of heartbleed?
- 19
1
vote
1
answer
58
views
Does Heartbleed pose a risk for past HTTPS communications?
Heartbleed exposes a threat where computer memory for a vulnerable could be exposed.
Consider an adversary with access to all cipher text input and output of your server (ISP, government, local ...
- 2,184
4
votes
2
answers
418
views
How do I distinguish between these two certificate situations?
Situation 1 (safe):
Website was vulnerable to heartbleed and using a certificate not valid before 2012-10-21
Website upgraded to an unvulnerable version of OpenSSL
Website re-keyed and got a their ...
user148324
1
vote
3
answers
2k
views
How to setup Apache HTTP server with the vulnerable OpenSSL
I want to do some test, so I want to set up an Apache HTTP server with the vulnerable OpenSSL (specifically with the Heartbleed bug), and I'd better do it from source.
How do I do that?
- 111
2
votes
1
answer
173
views
Tool/Procedure to Evaluate Whether Each Site in a Password Manager (e.g., KeePass, LastPass, Dashlane) is ready for a new password (post Heartbleed)? [closed]
Sites need to be remediated for the Heartbleed exploit before a password is updated. Some sites will be remediated immediately but others may not be updated for months. Lots of us have many dozens ...
- 501
87
votes
12
answers
27k
views
What's an efficient way to change my 200+ account passwords?
I have a lot of online accounts, web services, and so on -- personal as well as business -- so obviously(?) I use a password manager to handle them all. Specifically I use Lastpass but my question ...
- 18.1k
3
votes
1
answer
3k
views
Does Heartbleed Bug in OpenSSL affect ALL SSL certs
Does the Heartbleed Bug in OpenSSL affect ALL SSL certs, regardless of where I purchased or if I self-cert?
For example, if I bought an SSL certificate from GoDaddy and set this up on my server ...
- 153
2
votes
1
answer
3k
views
Which versions of the Windows TLS/SSL file transfer software like WinSCP and FileZilla are not affected by Heartbleed?
I noticed that many people still use versions affected by the heartbleed vulnerability of wide spread TLS/SSL enabled Windows clients like WinSCP and Filezilla.
To be able to make safe ...
- 1,533
119
votes
7
answers
17k
views
How to use the Internet while Heartbleed is being fixed?
There are many websites who are not currently vulnerable, but I have no idea if they were vulnerable a few days ago.
For example:
twitter.com: Not vulnerable right now, but the certificate is from ...
user148324
40
votes
2
answers
24k
views
Does Heartbleed affect ssh keys?
Does the recent Heartbleed bug affect the ssh keys I've generated and use to push/pull code with Github, Heroku, and other similar sites?
Do I need to replace the keys I've been using?
- 503
10
votes
3
answers
2k
views
Do end users need to do anything about the Heartbleed security bug? What?
I see in the news about the “Heartbleed” security bug. As an end user, do I need to do anything about it?
- 672
9
votes
3
answers
1k
views
What should I do about the Heartbleed bug for the sites I run?
The recently announced Heartbleed bug in OpenSSL affects many sites (70% of the internet).
There's a website:
http://www.heartbleed.com
There's a web-based test:
http://filippo.io/Heartbleed/
...
- 239
0
votes
0
answers
207
views
Blocking a trusted certificate in Google Chrome
Is it possible to somehow block a certain certificate that is currently trusted by my browser?
The reason is the recently discovered Heartbleed-attack which I also found out to affect my netbanking (...
- 101