OpenSSL bug

	Bottom Previous Topic Next Topic
Register To Post

Raziel

OpenSSL bug

Posted on: 2014/4/8 9:32 #1

Home away from home

OpenSSL has revealed a bug that can be used to read out secure data (passwords, emails, etc.)

Quote:

OpenSSL Security Advisory [07 Apr 2014]
========================================

TLS heartbeat read overrun (CVE-2014-0160)
==========================================

A missing bounds check in the handling of the TLS heartbeat extension can be
used to reveal up to 64k of memory to a connected client or server.

Only 1.0.1 and 1.0.2-beta releases of OpenSSL are affected including
1.0.1f and 1.0.2-beta1.

Thanks for Neel Mehta of Google Security for discovering this bug and to
Adam Langley <agl@chromium.org> and Bodo Moeller <bmoeller@acm.org> for
preparing the fix.

Affected users should upgrade to OpenSSL 1.0.1g. Users unable to immediately
upgrade can alternatively recompile OpenSSL with -DOPENSSL_NO_HEARTBEATS.

1.0.2 will be fixed in 1.0.2-beta2.

I don't know if AmiSSL is still maintained or all/most of todays programs use OpenSSL, it would be good if the authors of ports or programs using OpenSSL can update their respective work once 1.0.1g becomes available.
(The Main OpenSSL porter was informed)

People are dying.
Entire ecosystems are collapsing.
We are in the beginning of a mass extinction.
And all you can talk about is money and fairytales of eternal economic growth.
How dare you!
– Greta Thunberg

MickJT

Re: OpenSSL bug

Posted on: 2014/4/8 13:22 #2

Quite a regular

AmiSSL as far as I know won't be affected by that heartbeats vulnerability, although it is vulnerable in other ways. I think AWeb was updated recently with patches to turn off features of AmiSSL to avoid a vulnerability.

AmiSSL itself would still need an update to fix its other vulnerabilities.

Edited by MickJT on 2014/4/9 19:17:49

Raziel

Re: OpenSSL bug

Posted on: 2014/4/8 13:31 #3

Home away from home

@MickJT

Yes, one of the AmiSSL maintainers told me that a new version is in the pipeline which will skip this bug by using the fixed source base and take care of the other known ones.

Register To Post
	Top Previous Topic Next Topic

Currently Active Users Viewing This Thread: 1 ( 0 members and 1 Anonymous Users )