OpenSSL TLS Heartbeat Exploit

[Nobama4us]

https://github.com/titanous/heartbleeder

http://heartbleed.com/

[ocabj]

What sucks is that you can exfiltrate the server's private key. So even if after you patch, it's probably a good idea to rekey, regenerate a CSR, and reissue a new SSL certificate. Total PITA.

[ghost_shooter]

Missing bounds check for a security protocol layer? This is amazing!

[ocabj]

https://www.openssl.org/news/secadv_20140407.txt

If you run 0.9.8, it's not vulnerable. But if you're running a 1.x branch, you better pull source and recompile ASAP. Remember to restart all OpenSSL linked services, or just reboot your box completely.