nanog mailing list archives

Re: CVE-2014-0160 mitigation using iptables

From: Nick Hilliard <nick () foobar org>
Date: Thu, 10 Apr 2014 11:12:40 +0100

On 09/04/2014 11:07, Fabien Bourdaire wrote:

Following up on the CVE-2014-0160 vulnerability, heartbleed. We've
created some iptables rules to block all heartbeat queries using the
very powerful u32 module.


as someone pointed out on the UKNOF mailing list yesterday, you make a
number of assumptions in this ruleset which are not necessarily valid.

Please do not claim that this ruleset blocks all heartbeat queries because
it does not.

Nick

Current thread:

CVE-2014-0160 mitigation using iptables Fabien Bourdaire (Apr 10)
- Re: CVE-2014-0160 mitigation using iptables Nick Hilliard (Apr 10)
  - RE: CVE-2014-0160 mitigation using iptables David Hubbard (Apr 10)
- Re: CVE-2014-0160 mitigation using iptables Valdis . Kletnieks (Apr 10)
  - Re: CVE-2014-0160 mitigation using iptables shawn wilson (Apr 10)