Heartleech: Automated OpenSSL private key extraction tool using Heartbleed
1–10 of 78 posts
Re: Heartleech: Automated OpenSSL private key extraction tool using Heartbleed
#2Well, with the exploits for this vulnerability now showing up everywhere i almost feel bad for the people that still have not-patched servers lying around.
Re: Heartleech: Automated OpenSSL private key extraction tool using Heartbleed
#3I have a few ubuntu servers. When I do a "check for heartbleed" check with various tools, it says they are not vulnerable. However, these servers were installed 6 months ago and not updated for at least 2 months. How can they not be vulnerable?
Re: Heartleech: Automated OpenSSL private key extraction tool using Heartbleed
#4I have a few ubuntu servers. When I do a "check for heartbleed" check with various tools, it says they are not vulnerable. However, these servers were installed 6 months ago and not updated for at least 2 months. How can they not be vulnerable?
Maybe they use the GNU TLS library.
Re: Heartleech: Automated OpenSSL private key extraction tool using Heartbleed
#5I have a few ubuntu servers. When I do a "check for heartbleed" check with various tools, it says they are not vulnerable. However, these servers were installed 6 months ago and not updated for at least 2 months. How can they not be vulnerable?
You might want to rely on some other tool to determine if you are vulnerable or not. Or, just fix it yourself:
http://www.ansoncheunghk.info/article/3-simple-steps-update-...
Re: Heartleech: Automated OpenSSL private key extraction tool using Heartbleed
#6I have a few ubuntu servers. When I do a "check for heartbleed" check with various tools, it says they are not vulnerable. However, these servers were installed 6 months ago and not updated for at least 2 months. How can they not be vulnerable?
I am not an expert on the topic by any means, but one possibility is that older versions of impacted software are simply not vulnerable.
Re: Heartleech: Automated OpenSSL private key extraction tool using Heartbleed
#7I have a few ubuntu servers. When I do a "check for heartbleed" check with various tools, it says they are not vulnerable. However, these servers were installed 6 months ago and not updated for at least 2 months. How can they not be vulnerable?
I am not an expert on the topic by any means, but one possibility is that older versions of impacted software are simply not vulnerable.
Yep, older versions of OpenSSL are not vulnerable.
Re: Heartleech: Automated OpenSSL private key extraction tool using Heartbleed
#8I have a few ubuntu servers. When I do a "check for heartbleed" check with various tools, it says they are not vulnerable. However, these servers were installed 6 months ago and not updated for at least 2 months. How can they not be vulnerable?
[deleted]
Re: Heartleech: Automated OpenSSL private key extraction tool using Heartbleed
#9I have a few ubuntu servers. When I do a "check for heartbleed" check with various tools, it says they are not vulnerable. However, these servers were installed 6 months ago and not updated for at least 2 months. How can they not be vulnerable?
Are you http only?
Re: Heartleech: Automated OpenSSL private key extraction tool using Heartbleed
#10I have a few ubuntu servers. When I do a "check for heartbleed" check with various tools, it says they are not vulnerable. However, these servers were installed 6 months ago and not updated for at least 2 months. How can they not be vulnerable?
Older versions of OpenSSL were not vulnerable. Noticable 10.04 is not vulnerable.