OpenSSL heartbeat packet out-of-bounds read sensitive information leakage Vulnerability

Release date:

Cve id: CVE-2014-0160

Affected software and systems:
================================
OpenSSL 1.0.1-OpenSSL 1.0.1f
OpenSSL 1.0.2-beta
OpenSSL 1.0.2-beta1

Unaffected software and systems:
======================================
OpenSSL 0.9.8
OpenSSL 1.0.0
OpenSSL 1.0.1g
OpenSSL 1.0.2-beta2

Summary:
======
OpenSSL is an open-source SSL implementation that implements high-strength encryption for network communication. It is widely used in various network applications.

OpenSSL does not perform a boundary check in processing TLS heartbeat extensions, which may cause 64 KB of memory information to be leaked to connected clients or servers. Only 1.0.1 and 1.0.2-beta versions of OpenSSL are affected, including 1.0.1f and 1.0.2-beta1.

Considering the severity of this vulnerability, it is recommended that users of the affected version upgrade to the latest version immediately.

Analysis:
======
A tls heartbeat consists of a request packet, which includes a payload. The other party that communicates will read the packet and send a response containing the same load. In the code that processes heartbeat requests, the load size is read from the attacker's controllable package. OpenSSL does not check the load size value, leading to out-of-bounds reading, resulting in sensitive information leakage.
The leaked information may include the encrypted private key and other sensitive information such as the user name and password.

Solution:
============
We recommend that you upgrade NSFOCUS to OpenSSL 1.0.1g. However, if you cannot install or upgrade the patch immediately, you can take the following measures to reduce the threat:
* Use the-DOPENSSL_NO_HEARTBEATS option to re-compile OpenSSL.

Vendor status:
============
Openssl 1.0.1g has been released to fix this problem ,:

Vendor security announcement:
Https://www.openssl.org/news/secadv_20140407.txt

For OpenSSL 1.0.2 Releases, the vendor indicates that it will be fixed in 1.0.2-beta2.

Major Linux distributions have also released patches. Please upgrade them as soon as possible.

Additional information:
============
1. https://www.openssl.org/news/secadv_20140407.txt
2. http://heartbleed.com/

OpenSSL details: click here
OpenSSL: click here

OpenSSL TLS heartbeat read remote information leakage (CVE-2014-0160)

Severe OpenSSL bug allows attackers to read 64 KB of memory, fixed in half an hour in Debian

OpenSSL "heartbleed" Security Vulnerability

Provides FTP + SSL/TLS authentication through OpenSSL and implements secure data transmission.

Heartbleed test -- OpenSSL vulnerability testing tool