As of May 31, 2023, we have updated our Code of Conduct.

Questions tagged [heartbleed]

Security vulnerability in OpenSSL allowing an attacker to obtain SSL keys, passwords, and other secure data from a server or client

Filter by
Sorted by
Tagged with
1 vote
1 answer
71 views

HeartBleed and Client certificates

Is it true that a server, setup to require a client certificate, cannot suffer from the Heartbleed vulnerability, if that user does not have a client certificate?
Myforwik's user avatar
1 vote
3 answers
651 views

Compile Heartbleed.c Tester On CentOS 6.x

I have been looking for days now for a solution to this, basically I am trying to test my network for the heartbleed bug, but I am unable to compile the tester on CentOS 6.x, any ideas or suggestions ...
Jeffrey L. Roberts's user avatar
-1 votes
1 answer
46 views

How can I secure Windows from heartbleed

I just fixed my openssl version on debianwheezy and updated my android device away from version 1.1.1 but the only thing that is missing is my windows-PC. My question now is, how is windows 7 ...
user3005255's user avatar
6 votes
2 answers
2k views

Heartbleed "Unexpected message"

I have a task to verify our company's software patch which addresses Heartbleed attack. Now, I am certain that version of software I am trying to exploit uses 1.0.1e OpenSSL library, which should be ...
Jovan Perovic's user avatar
1 vote
2 answers
19k views

How to get the OpenSSL version in a Tomcat 6 installation

After reading an article about the Heartbleed security bug, I understand that it is good practice to check the OpenSSL version Apache Tomcat is using. The article contains this sentence: What ...
Ziba Leah's user avatar
  • 133
-1 votes
2 answers
322 views

If man-in-the-middle attacks are rare, is Heartbleed as serious as suggested? [closed]

I connect to the internet on a secured wireless connection. I'm pretty sure nobody has MITM'd me on my LAN. How else could someone using Heartbleed to steal private keys access my data? I understand ...
Cameron's user avatar
0 votes
3 answers
129 views

How do I know if a site is vulnerable to the Heartbleed bug?

So, I was thinking I should probably start changing my passwords after hearing all the talk about the Heartbleed bug. However, I then started thinking, what is the point of changing my password at a ...
phaz's user avatar
  • 298
6 votes
4 answers
21k views

apt-get upgrade openssl won't bring Ubuntu 12.04 to latest version

I've tried the following, but I can't get a build date later than: Tue, Aug 21 05:18:46 UTC 2012 I have done the following: apt-get dist-upgrade apt-get update apt-get upgrade openssl and apt-get ...
user1182988's user avatar
0 votes
1 answer
1k views

After the Heartbleed bug, do we need to update our OpenSSL DLL's?

Our software we develop uses the Indy internet component suite in Delphi. Indy has capabilities for OpenSSL. Since the Heartbleed incident, we're wondering if we need to take action. We distribute 2 ...
Jerry Dodge's user avatar
0 votes
1 answer
429 views

Do I have to install Openssl 1.0.1g in usr/local/lib64 to overwrite usr/lib64 one? (CentOS 6.4, heartbleed issue)

I am using a VPS, I need to upgrade openssl with the new package in consequence of the heartbleed vulnerability issue. But I am a newbie in managing server, I need to know if I am getting this right :...
Tritof's user avatar
  • 115
1 vote
2 answers
103 views

Heartbleed threat: Do I need to change password for websites that I rarely logon?

I've a dozen email accounts, probably a hundred websites and forum accounts and I don't want to go about changing all the passwords. Do I need to change the password of websites that I seldom logon - ...
Joshua Lim's user avatar
0 votes
2 answers
151 views

heartbleed are CA private keys compromised?

have any CA private keys such as those used by godaddy to issue private/public key pairs compromised as a result of heartbleed?
rory's user avatar
  • 19
1 vote
1 answer
58 views

Does Heartbleed pose a risk for past HTTPS communications?

Heartbleed exposes a threat where computer memory for a vulnerable could be exposed. Consider an adversary with access to all cipher text input and output of your server (ISP, government, local ...
William Entriken's user avatar
4 votes
2 answers
418 views

How do I distinguish between these two certificate situations?

Situation 1 (safe): Website was vulnerable to heartbleed and using a certificate not valid before 2012-10-21 Website upgraded to an unvulnerable version of OpenSSL Website re-keyed and got a their ...
user avatar
1 vote
3 answers
2k views

How to setup Apache HTTP server with the vulnerable OpenSSL

I want to do some test, so I want to set up an Apache HTTP server with the vulnerable OpenSSL (specifically with the Heartbleed bug), and I'd better do it from source. How do I do that?
ytliu's user avatar
  • 111
2 votes
1 answer
173 views

Tool/Procedure to Evaluate Whether Each Site in a Password Manager (e.g., KeePass, LastPass, Dashlane) is ready for a new password (post Heartbleed)? [closed]

Sites need to be remediated for the Heartbleed exploit before a password is updated. Some sites will be remediated immediately but others may not be updated for months. Lots of us have many dozens ...
BillR's user avatar
  • 501
87 votes
12 answers
27k views

What's an efficient way to change my 200+ account passwords?

I have a lot of online accounts, web services, and so on -- personal as well as business -- so obviously(?) I use a password manager to handle them all. Specifically I use Lastpass but my question ...
Torben Gundtofte-Bruun's user avatar
3 votes
1 answer
3k views

Does Heartbleed Bug in OpenSSL affect ALL SSL certs

Does the Heartbleed Bug in OpenSSL affect ALL SSL certs, regardless of where I purchased or if I self-cert? For example, if I bought an SSL certificate from GoDaddy and set this up on my server ...
bwright's user avatar
  • 153
2 votes
1 answer
3k views

Which versions of the Windows TLS/SSL file transfer software like WinSCP and FileZilla are not affected by Heartbleed?

I noticed that many people still use versions affected by the heartbleed vulnerability of wide spread TLS/SSL enabled Windows clients like WinSCP and Filezilla. To be able to make safe ...
mit's user avatar
  • 1,533
119 votes
7 answers
17k views

How to use the Internet while Heartbleed is being fixed?

There are many websites who are not currently vulnerable, but I have no idea if they were vulnerable a few days ago. For example: twitter.com: Not vulnerable right now, but the certificate is from ...
user avatar
40 votes
2 answers
24k views

Does Heartbleed affect ssh keys?

Does the recent Heartbleed bug affect the ssh keys I've generated and use to push/pull code with Github, Heroku, and other similar sites? Do I need to replace the keys I've been using?
LikeMaBell's user avatar
10 votes
3 answers
2k views

Do end users need to do anything about the Heartbleed security bug? What?

I see in the news about the “Heartbleed” security bug. As an end user, do I need to do anything about it?
danorton's user avatar
  • 672
9 votes
3 answers
1k views

What should I do about the Heartbleed bug for the sites I run?

The recently announced Heartbleed bug in OpenSSL affects many sites (70% of the internet). There's a website: http://www.heartbleed.com There's a web-based test: http://filippo.io/Heartbleed/ ...
Matt Cruikshank's user avatar
0 votes
0 answers
207 views

Blocking a trusted certificate in Google Chrome

Is it possible to somehow block a certain certificate that is currently trusted by my browser? The reason is the recently discovered Heartbleed-attack which I also found out to affect my netbanking (...
FrankyBoy's user avatar
  • 101