OpenSSL Bug Allows Attackers To Read Memory In 64k Chunks 303
Bismillah (993337) writes "A potentially very serious bug in OpenSSL 1.0.1 and 1.0.2 beta has been discovered that can leak just about any information, from keys to content. Better yet, it appears to have been introduced in 2011, and known since March 2012."
Quoting the security advisory: "A missing bounds check in the handling of the TLS heartbeat extension can be used to reveal up to 64k of memory to a connected client or server." The attack may be repeated and it appears trivial to acquire the host's private key. If you were running a vulnerable release, it is even suggested that you go as far as revoking all of your keys. Distributions using OpenSSL 0.9.8 are not vulnerable (Debian Squeeze vintage). Debian Wheezy, Ubuntu 12.04.4, Centos 6.5, Fedora 18, SuSE 12.2, OpenBSD 5.4, FreeBSD 8.4, and NetBSD 5.0.2 and all following releases are vulnerable. OpenSSL released 1.0.1g today addressing the vulnerability. Debian's fix is in incoming and should hit mirrors soon, Fedora is having some trouble applying their patches, but a workaround patch to the package .spec (disabling heartbeats) is available for immediate application.
Thanks Jerks (Score:5, Funny)
Now how are we supposed to collect people's private information without their knowledge? Think of the children and all of the terrorists captured with this exploit in the wild!
sincerely,
NSA
No Problem Here (Score:5, Funny)
Never trusted openssl - only use GnuTLS.
http://www.theregister.co.uk/2... [theregister.co.uk]
Theo? (Score:1, Funny)
Could someone please give Theo a heap of grief over this from me? He's always so quick to bag out GnuTLS and others when they have an issue. Only fair he gets a share of what he dishes out. Besides, this seems to be even worse than a "goto fail"...
Um, whoosh? (Score:2, Funny)
How the fuck did this get modded up? Idiot mods (and "DarwinSurvivor", apparently) can't read a link, I guess...
The only way this could have been stupider is if it was actually the same link, instead of merely being a link that I could tell, just from the URL, was about exactly the same issue.
Morons.
Windows (Score:5, Funny)
Good thing I use WIndows, so I'm safe.
Yes!!! (Score:5, Funny)
*air-punch*
I knew procrastinating Debian upgrades for most of a decade would pay off! I am VINDICATED!
Re:Ironic (Score:5, Funny)
Re:Windows (Score:5, Funny)
Unfortunately it is XP, so you are safe until 12:00.
Re:It's really annoying (Score:4, Funny)
This bug is almost 10 years old
Well look who natively counts in binary.
Hello Joshua! Give my regards to Dr Falken.