Re: [Haifux] The Heartbeat vulnerability in OpenSSL

2014-04-11 Thread Eli Billauer 




Thanks for that one, Tzafrir.

In fact, I did try a Python script on my SSH server, and it just failed
to run through the test (connection reset by peer). It makes sense now.
:)

And now when you said it, it's quite easy to confirm that all over the
web.

http://security.stackexchange.com/questions/1599/what-is-the-difference-between-ssl-vs-ssh-which-is-more-secure

So it's all about https. Phew!

   Eli


On 11/04/14 15:43, Tzafrir Cohen wrote:

  SSH is safe from this - it does not use this mechanism. Its protocol is
different.Likewise is GPG is safe from this bug as it is built with
GnuTLS.

  




-- 
Web: http://www.billauer.co.il



___
Haifux mailing list
Haifux@haifux.org
http://haifux.org/mailman/listinfo/haifux

Re: [Haifux] The Heartbeat vulnerability in OpenSSL (and hence ssh/https)

2014-04-11 Thread Tzafrir Cohen 
On Fri, Apr 11, 2014 at 08:35:00AM +0300, Eli Billauer wrote:
> Hi all,
> 
> I suppose that the security freaks already know about this, and still, 
> this seems important enough for an alert.
> 
> In a nutshell, a bug in the mechanism that allows keepalive messages to 
> be sent to maintain an SSL link, also allows, accidentally, a remote 
> attacker to read a segment of up to 64 kBytes from the server's memory. 
> It's doesn't give access to any chunk of 64 kBytes, but it's a segment 
> which is likely to be dirty with data that belongs to the process 
> running openSSL. So there's a chance that data related to private keys 
> and passwords is revealed this way.
> 
> See http://en.wikipedia.org/wiki/Heartbleed
> 
> I haven't found any tool checking a local SSH server, say as source code 
> in C. I suppose it's being avoided for the sake of not supplying the 
> almost-finished attack to script kiddies.

SSH is safe from this - it does not use this mechanism. Its protocol is
different.Likewise is GPG is safe from this bug as it is built with
GnuTLS.

-- 
Tzafrir Cohen | tzaf...@jabber.org | VIM is
http://tzafrir.org.il || a Mutt's
tzaf...@cohens.org.il ||  best
tzaf...@debian.org|| friend
___
Haifux mailing list
Haifux@haifux.org
http://haifux.org/mailman/listinfo/haifux