Editing Talk:1353: Heartbleed
|
Please sign your posts with ~~~~ |
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.
The edit can be undone.
Please check the comparison below to verify that this is what you want to do, and then save the changes below to finish undoing the edit.
| Latest revision | Your text | ||
| Line 16: | Line 16: | ||
Should this be incorperated into the main explanation, and how should it be formated | Should this be incorperated into the main explanation, and how should it be formated | ||
[[User:Jonv4n|Jonv4n]] ([[User talk:Jonv4n|talk]]) 08:07, 9 April 2014 (UTC) | [[User:Jonv4n|Jonv4n]] ([[User talk:Jonv4n|talk]]) 08:07, 9 April 2014 (UTC) | ||
| + | ---- | ||
| + | |||
OpenSSL Security Advisory [07 Apr 2014] | OpenSSL Security Advisory [07 Apr 2014] | ||
| + | ======================================== | ||
| + | |||
TLS heartbeat read overrun (CVE-2014-0160) | TLS heartbeat read overrun (CVE-2014-0160) | ||
| + | ========================================== | ||
A missing bounds check in the handling of the TLS heartbeat extension can be | A missing bounds check in the handling of the TLS heartbeat extension can be | ||
| Line 34: | Line 39: | ||
1.0.2 will be fixed in 1.0.2-beta2. | 1.0.2 will be fixed in 1.0.2-beta2. | ||
| + | |||
| + | ---- | ||
| + | |||
:Actually, attack is limited to data in memory of the webserver PROCESS. Even on affected computers, other applications are safe and most of disk content is safe. Not speaking about the fact that in many cases, the public-facing webserver is just proxy cache before the real ones. The real problem is if someone immediately used the revealed data - either to impersonate the server or for example found the admin password and used it to copy the database ... which DOES leave traces. I agree with Cueball: there can be worse kind of bug. In fact, I'm sure that what Edward Snowden revealed is worse, although not technically bug. -- [[User:Hkmaly|Hkmaly]] ([[User talk:Hkmaly|talk]]) 10:18, 9 April 2014 (UTC) | :Actually, attack is limited to data in memory of the webserver PROCESS. Even on affected computers, other applications are safe and most of disk content is safe. Not speaking about the fact that in many cases, the public-facing webserver is just proxy cache before the real ones. The real problem is if someone immediately used the revealed data - either to impersonate the server or for example found the admin password and used it to copy the database ... which DOES leave traces. I agree with Cueball: there can be worse kind of bug. In fact, I'm sure that what Edward Snowden revealed is worse, although not technically bug. -- [[User:Hkmaly|Hkmaly]] ([[User talk:Hkmaly|talk]]) 10:18, 9 April 2014 (UTC) | ||
| Line 40: | Line 48: | ||
" | " | ||
''If the certificate is registered the browser accepts it.'' This is incorrect. Server certificates aren't accepted because they're registered, they're accepted because they can prove a chain of trust up to a CA certificate which is explicitly trusted. Ironically, certificates only need to be registered when they're revoked (on a CRL - certificate revocation list). The whole idea of the digital certificate system we use is that of federated trust, which requires no online lookup to validate a certificate. [[User:Jezzaaaa|Jezzaaaa]] ([[User talk:Jezzaaaa|talk]]) 22:19, 10 April 2014 (UTC) | ''If the certificate is registered the browser accepts it.'' This is incorrect. Server certificates aren't accepted because they're registered, they're accepted because they can prove a chain of trust up to a CA certificate which is explicitly trusted. Ironically, certificates only need to be registered when they're revoked (on a CRL - certificate revocation list). The whole idea of the digital certificate system we use is that of federated trust, which requires no online lookup to validate a certificate. [[User:Jezzaaaa|Jezzaaaa]] ([[User talk:Jezzaaaa|talk]]) 22:19, 10 April 2014 (UTC) | ||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
