Downgraded and tested again. Testing Tor with ssltest.py shows successful SSL connection and no response to the heartbeat request, reports not vulnerable. Testing OpenVPN - TCP connection OK, SSL connection fails, server reports MTU discrepancy. Complaining that a 277 byte frame does not have a length between 0 and 1559 - possibly not vulnerable. Apache, Postfix and Courier instances were all vulnerable. -----Original Message----- From: Nik Mitev <nik@xxxxxxxxx> To: fulldisclosure@xxxxxxxxxxxx Subject: Re: [FD] heartbleed OpenSSL bug CVE-2014-0160 Date: Tue, 08 Apr 2014 11:31:46 +0100 I used the tool Kirils linked (http://possible.lv/tools/hb/) and my unpatched servers running a Tor node or an Openvpn server returned correct (old) version of openssl but not vulnerable. Is it the bug or the tool that seems to be limited to https I wonder? Patched now so can't test with this tool... -----Original Message----- From: Fraser Scott <fraser.scott@xxxxxxxxx> To: fulldisclosure@xxxxxxxxxxxx Subject: Re: [FD] heartbleed OpenSSL bug CVE-2014-0160 Date: Tue, 8 Apr 2014 10:24:02 +0100 This seems to be the best test so far: http://s3.jspenguin.org/ssltest.py Other tests false-positive on patched versions from what I can see. On 8 April 2014 01:10, Kirils Solovjovs <kirils.solovjovs@xxxxxxxxxx> wrote: > We are doomed. > > Description: http://www.openssl.org/news/vulnerabilities.html > Article dedicated to the bug: http://heartbleed.com/ > Tool to check if TLS heartbeat extension is supported: > http://possible.lv/tools/hb/ > > A missing bounds check in the handling of the TLS heartbeat extension > can be used to reveal up to 64kB of memory to a connected client or server. > > 1.0.1[ abcdef] affected. > > > P.S. Happy Monday! > > _______________________________________________ > Sent through the Full Disclosure mailing list > http://nmap.org/mailman/listinfo/fulldisclosure > Web Archives & RSS: http://seclists.org/fulldisclosure/ > _______________________________________________ Sent through the Full Disclosure mailing list http://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/ _______________________________________________ Sent through the Full Disclosure mailing list http://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Attachment:
signature.asc
Description: This is a digitally signed message part
_______________________________________________ Sent through the Full Disclosure mailing list http://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/