Heartbleed OpenSSL Vulnerability (Important!)

I'm going with that this bug is very over dramatized... but that's just me.

Nope. Srs bizniz.

Basically the exploit allows you to access the memory of a server running Vulnerable versions of OpenSSL (about 2 years of past versions). What makes this bug so prolific is the fact you require no access or elevated permissions to be able to exploit it, where as many other bugs you probably would need at least some form of access to the server.

Whats stored in the memory? All the unencrypted data that OpenSSL is currently running, or infact anything running on the system.

Its known as an under-buffer attack. You'll send the server a string of X bytes, but tell it it is actually Z bytes. When the server responds it will pull data from the memory to fill up the empty bytes. That data it has pulled could be anything in the system memory at the time, doesn't even need to be related to the OpenSSL process. Private SSL Keys, passwords, entropy, anything at all. Its a C thing.

XKCD posted an image illustrating heartbleed this morning

I'm going with that this bug is very over dramatized... but that's just me.

Nope. Srs bizniz.

Basically the exploit allows you to access the memory of a server running Vulnerable versions of OpenSSL (about 2 years of past versions). What makes this bug so prolific is the fact you require no access or elevated permissions to be able to exploit it, where as many other bugs you probably would need at least some form of access to the server.

Whats stored in the memory? All the unencrypted data that OpenSSL is currently running, or infact anything running on the system.

Its known as an under-buffer attack. You'll send the server a string of X bytes, but tell it it is actually Z bytes. When the server responds it will pull data from the memory to fill up the empty bytes. That data it has pulled could be anything in the system memory at the time, doesn't even need to be related to the OpenSSL process. Private SSL Keys, passwords, entropy, anything at all. Its a C thing.

Oh I know what it is, I'm just saying it was patched on meaningful servers before anybody could probably exploit. Of course there's no way to tell, that's just what I think.

Hey if any one is still interested there is a really good expiation of exactly why and how this bug happened.
http://vimeo.com/91425662