OpenSSL TLS 'heartbeat' Extension Information Disclosure Vulnerability

  1. Network Vulnerabilities
  2. General
  3. OpenSSL TLS 'heartbeat' Extension Information Disclosure Vulnerability
Summary
OpenSSL is prone to an information disclosure vulnerability.
Impact
An attacker can exploit this issue to gain access to sensitive information that may aid in further attacks.
Solution
Updates are available.
Insight
The TLS and DTLS implementations do not properly handle Heartbeat Extension packets.
Affected
OpenSSL 1.0.1f, 1.0.1e, 1.0.1d, 1.0.1c, 1.0.1b, 1.0.1a, and 1.0.1 are vulnerable.
Detection
Send a special crafted TLS request and check the response.
References
Updated on 2015-03-25
Severity
Medium Severity
Classification
Related Vulnerabilities