I just read an article titled "Why heartbleed doesn't leak the private key" and the claim seems irresponsible and overly broad. Can anyone comment on his analysis?
http://blog.erratasec.com/2014/04/why-heartbleed-doesnt-leak-private-key.html#.U0WjNK1dWBg On Mon, Apr 7, 2014 at 5:10 PM, Kirils Solovjovs < kirils.solovj...@kirils.com> wrote: > We are doomed. > > Description: http://www.openssl.org/news/vulnerabilities.html > Article dedicated to the bug: http://heartbleed.com/ > Tool to check if TLS heartbeat extension is supported: > http://possible.lv/tools/hb/ > > A missing bounds check in the handling of the TLS heartbeat extension > can be used to reveal up to 64kB of memory to a connected client or server. > > 1.0.1[ abcdef] affected. > > > P.S. Happy Monday! > > _______________________________________________ > Sent through the Full Disclosure mailing list > http://nmap.org/mailman/listinfo/fulldisclosure > Web Archives & RSS: http://seclists.org/fulldisclosure/ > -- Jeremy Voorhis _______________________________________________ Sent through the Full Disclosure mailing list http://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
