What is Heartbleed?

by Ongoing Operations

Heartbleed or CVE-2014-0160 is a zero day vulnerability discovered on versions of OpenSSL between 1.0.1 and 1.0.1g. The vulnerability allows attackers to access sensitive information in memory.

What does all this mean???

OpenSSL is an open source (free-ish) version of the core components used to encrypt things like webpages. It is integrated into many linux based appliances and non-windows web servers.
If you are running a web server or appliance that does ssl (mostly used in secure websites using https) it may use the OpenSSL library to preform encryption.

Most implementations of Microsoft web servers using IIS are NOT affected.

To find out more about the vulnerability you can check out http://heartbleed.com or NIST’s report at https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0160

continue reading »