oss-sec mailing list archives
RE: OpenSSL 1.0.1 TLS/DTLS hearbeat information disclosure CVE-2014-0160
From: Bobby Broughton <bobby () invehosting com>
Date: Tue, 8 Apr 2014 16:44:00 -0400
Once you gain a session id, you can hijack the person's session allowing for unauthorized access. Here's a good article: https://www.mattslifebytes.com/?p=533 Sent from my Verizon Wireless 4G LTE smartphone -------- Original message -------- From: Donald Stufft Date:04/08/2014 4:28 PM (GMT-05:00) To: oss-security () lists openwall com Subject: Re: [oss-security] OpenSSL 1.0.1 TLS/DTLS hearbeat information disclosure CVE-2014-0160 On Apr 8, 2014, at 3:37 PM, Yves-Alexis Perez <corsac () debian org> wrote:
(for example, I'm still unsure how easy it really is to find some valuable data in those 64kB of process heap memory).
Real easy, here’s a Python script which looks for cookies https://gist.github.com/mitsuhiko/10130454 ----------------- Donald Stufft PGP: 0x6E3CBCE93372DCFA // 7C6B 7C5D 5E2B 6356 A926 F04F 6E3C BCE9 3372 DCFA
Current thread:
- Re: OpenSSL 1.0.1 TLS/DTLS hearbeat information disclosure CVE-2014-0160, (continued)
- Re: OpenSSL 1.0.1 TLS/DTLS hearbeat information disclosure CVE-2014-0160 Jussi Eronen (Apr 25)
- Re: OpenSSL 1.0.1 TLS/DTLS hearbeat information disclosure CVE-2014-0160 Donald Stufft (Apr 08)
- Re: OpenSSL 1.0.1 TLS/DTLS hearbeat information disclosure CVE-2014-0160 Vincent Danen (Apr 08)
- Re: OpenSSL 1.0.1 TLS/DTLS hearbeat information disclosure CVE-2014-0160 Florian Weimer (Apr 08)
- Re: OpenSSL 1.0.1 TLS/DTLS hearbeat information disclosure CVE-2014-0160 Huzaifa Sidhpurwala (Apr 08)
- Re: OpenSSL 1.0.1 TLS/DTLS hearbeat information disclosure CVE-2014-0160 Yves-Alexis Perez (Apr 09)
- Re: OpenSSL 1.0.1 TLS/DTLS hearbeat information disclosure CVE-2014-0160 Huzaifa Sidhpurwala (Apr 09)
- Re: OpenSSL 1.0.1 TLS/DTLS hearbeat information disclosure CVE-2014-0160 Marcus Meissner (Apr 09)
- Re: OpenSSL 1.0.1 TLS/DTLS hearbeat information disclosure CVE-2014-0160 Marc Deslauriers (Apr 09)