[170772] in North American Network Operators' Group
Re: Serious bug in ubiquitous OpenSSL library: "Heartbleed"
daemon@ATHENA.MIT.EDU (Laszlo Hanyecz)
Tue Apr 8 15:15:23 2014
From: Laszlo Hanyecz <laszlo@heliacal.net>
In-Reply-To: <008501cf535e$6b0e6350$412b29f0$@iname.com>
Date: Tue, 8 Apr 2014 19:14:57 +0000
To: "Frank Bulk" <frnkblk@iname.com>
Cc: NANOG <nanog@nanog.org>
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
You can still potentially access all the same information since it all =
goes through the load balancer. Interesting bits of info are things =
like Cookie: headers being sent by clients and sitting in a buffer. Try =
one of the testing tools mentioned and see if you can see any info from =
other clients. It's almost like having remote tcpdump on the web server =
- you can copy down the in-memory process image.
-Laszlo
On Apr 8, 2014, at 7:12 PM, "Frank Bulk" <frnkblk@iname.com> wrote:
> If we would front our HTTPS services with a (OpenSSL vulnerable)
> load-balancer that does the SSL work and we just use HTTP to the =
service,
> will that mitigate information loss that's possible with this exploit? =
Or
> will the OpenSSL code on the load-balancer also store or "cache" =
content?
>=20
> Frank
>=20
> -----Original Message-----
> From: Paul Ferguson [mailto:fergdawgster@mykolab.com]=20
> Sent: Tuesday, April 08, 2014 12:07 AM
> To: NANOG
> Subject: Fwd: Serious bug in ubiquitous OpenSSL library: "Heartbleed"
>=20
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
>=20
> I'm really surprised no one has mentioned this here yet...
>=20
> FYI,
>=20
> - - ferg
>=20
>=20
>=20
> Begin forwarded message:
>=20
>> From: Rich Kulawiec <rsk@gsp.org> Subject: Serious bug in
>> ubiquitous OpenSSL library: "Heartbleed" Date: April 7, 2014 at
>> 9:27:40 PM EDT
>>=20
>> This reaches across many versions of Linux and BSD and, I'd
>> presume, into some versions of operating systems based on them.
>> OpenSSL is used in web servers, mail servers, VPNs, and many other
>> places.
>>=20
>> Writeup: Heartbleed: Serious OpenSSL zero day vulnerability
>> revealed=20
>>=20
> =
http://www.zdnet.com/heartbleed-serious-openssl-zero-day-vulnerability-rev=
ea
> led-7000028166/
>>=20
>> Technical details: Heartbleed Bug http://heartbleed.com/
>>=20
>> OpenSSL versions affected (from link just above): OpenSSL 1.0.1
>> through 1.0.1f (inclusive) are vulnerable OpenSSL 1.0.1g is NOT
>> vulnerable (released today, April 7, 2014) OpenSSL 1.0.0 branch is
>> NOT vulnerable OpenSSL 0.9.8 branch is NOT vulnerable
>>=20
>=20
>=20
> - --=20
> Paul Ferguson
> VP Threat Intelligence, IID
> PGP Public Key ID: 0x54DC85B2
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v2.0.22 (MingW32)
> Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
>=20
> iF4EAREIAAYFAlNDg9gACgkQKJasdVTchbIrAAD9HzKaElH1Tk0oIomAOoSOvfJf
> 3Dvt4QB54os4/yewQQ8A/0dhFZ/YuEdA81dkNfR9KIf1ZF72CyslSPxPvkDcTz5e
> =3DaAzE
> -----END PGP SIGNATURE-----
>=20
>=20
>=20
>=20
