Re: heartbleed OpenSSL bug CVE-2014-0160

[Seth Arnold <seth.arnold () canonical com>]

On Fri, Apr 11, 2014 at 01:09:37PM +0200, Reindl Harald wrote:
> interesting, i have until now 3 mail client-IPs triggering that rules on
> 993 and 995 one of them is our own external office, the other two are
> using AppleMail too
>
> anybody an idea why Mail.app is using Heartbeat packets on POP3s and
> IMAPs?

No idea on pop3.

But a long-lived imap4 connection waiting in IDLE may cause a stateful
firewall (such as common consumer NAT routers) to time-out a connection as
"inactive" after a while. That might result in apparently hung connections
or otherwise unreliable services. TLS heartbeats would be a convenient
way to keep the connection alive through such firewalls and provide a
more reliable service to users.

Thanks

Attachment: signature.asc
Description: Digital signature

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/