Re: http://heartbleed.com/

On 08.04.14 15:45, Mike Tancsa wrote:

>     I am trying to understand the implications of this bug in the
> context of a vulnerable client, connecting to a server that does not
> have this extension.  e.g. a client app linked against 1.xx thats
> vulnerable talking to a server that is running something from RELENG_8
> in the base (0.9.8.x).  Is the server still at risk ? Will the client
> still bleed information ?

If the adversary is in control of the network and can MITM the
connection, then yes. The client leaks random chunks of up to 64k
memory, and that is for each heartbeat request the server sends.

  erdgeist
_______________________________________________
freebsd-security@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org"