Heartbleed

---

Heartbleed is a security vulnerability discovered in the widely used OpenSSL cryptographic software library.

• bug allows an attacker to read sensitive information from the memory of a vulnerable web server
  • e.g., private keys, usernames, passwords
• existed in the OpenSSL implementation of TLS protocol’s heartbeat extension
• significant because OpenSSL is widely used for secure communication over Internet
  • affected a large percent of all web servers
• highlights the importance of regular software patching and vulnerability management

How it Works

• in vulnerable versions of OpenSSL,
• an attacker can send a malformed heartbeat request that causes the server to leak up to 64 kilobytes of memory data in response
  • potentially revealing sensitive information

Mitigate

• upgrade OpenSSL software
• revoke and reissue any compromised SSL/TLS certificates
• encourage users to change passwords on affected systems