CVE-2014-0160
CVE-2014-0160
In short
OpenSSL's Heartbeat feature has a flaw that lets attackers read sensitive data like private keys directly from server memory by sending specially crafted requests. This is critical because it exposes private encryption keys that should never be shared.
Technical detail
The Heartbeat Extension in OpenSSL 1.0.1 before 1.0.1g contains an out-of-bounds read vulnerability in the heartbeat response mechanism (d1_both.c, t1_lib.c). Remote attackers can trigger a buffer over-read via crafted heartbeat packets without authentication, allowing exfiltration of arbitrary process memory including private keys and other sensitive data.
Summary generated and translated by AI from the official description.
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
n/a · n/apublic PoCs found — 78
githubgithub.com/FiloSottile/Heartbleed★ 2390githubgithub.com/musalbas/heartbleed-masstest★ 574githubgithub.com/titanous/heartbleeder★ 452githubgithub.com/Lekensteyn/pacemaker★ 330githubgithub.com/sensepost/heartbleed-poc★ 170githubgithub.com/einaros/heartbleed-tools★ 98githubgithub.com/mpgn/heartbleed-PoC★ 85githubgithub.com/isgroup/openmagic★ 40githubgithub.com/jdauphant/patch-openssl-CVE-2014-0160★ 19githubgithub.com/DisK0nn3cT/MaltegoHeartbleed★ 18githubgithub.com/hmlio/vaas-cve-2014-0160★ 15githubgithub.com/OffensivePython/HeartLeak★ 15githubgithub.com/hybridus/heartbleedscanner★ 11githubgithub.com/0x90/CVE-2014-0160★ 8githubgithub.com/DominikTo/bleed★ 7githubgithub.com/0xinf0/bleeding_onions★ 6githubgithub.com/undacmic/heartbleed-proof-of-concept★ 5githubgithub.com/anthophilee/A2SV--SSL-VUL-Scan★ 5githubgithub.com/hreese/heartbleed-dtls★ 5githubgithub.com/yryz/heartbleed.js★ 4githubgithub.com/mozilla-services/Heartbleed★ 3githubgithub.com/ingochris/heartpatch.us★ 3githubgithub.com/cyphar/heartthreader★ 2githubgithub.com/amerine/coronary★ 2githubgithub.com/cheese-hub/heartbleed★ 2githubgithub.com/GuillermoEscobero/heartbleed★ 2githubgithub.com/zouguangxian/heartbleed★ 2githubgithub.com/indrajeetmp11/Heartbleed-PoC-Exploit-Script★ 2githubgithub.com/pblittle/aws-suture★ 2githubgithub.com/GardeniaWhite/fuzzing★ 2githubgithub.com/waqasjamal-zz/HeartBleed-Vulnerability-Checker★ 2githubgithub.com/belmind/heartbleed★ 1githubgithub.com/Xyl2k/CVE-2014-0160-Chrome-Plugin★ 1githubgithub.com/Saymeis/HeartBleed★ 1githubgithub.com/proactiveRISK/heartbleed-extention★ 1githubgithub.com/xanas/heartbleed.py★ 1githubgithub.com/sammyfung/openssl-heartbleed-fix★ 1githubgithub.com/xlucas/heartbleed★ 1githubgithub.com/vortextube/ssl_scanner★ 1githubgithub.com/pierceoneill/bleeding-heart★ 0githubgithub.com/obayesshelton/CVE-2014-0160-Scanner★ 0githubgithub.com/fb1h2s/CVE-2014-0160★ 0githubgithub.com/takeshixx/ssl-heartbleed.nse★ 0githubgithub.com/roganartu/heartbleedchecker-chrome★ 0githubgithub.com/ice-security88/CVE-2014-0160★ 0githubgithub.com/siddolo/knockbleed★ 0githubgithub.com/a0726h77/heartbleed-test★ 0githubgithub.com/idkqh7/heatbleeding★ 0githubgithub.com/GeeksXtreme/ssl-heartbleed.nse★ 0githubgithub.com/indiw0rm/-Heartbleed-★ 0githubgithub.com/iSCInc/heartbleed★ 0githubgithub.com/marstornado/cve-2014-0160-Yunfeng-Jiang★ 0githubgithub.com/froyo75/Heartbleed_Dockerfile_with_Nginx★ 0githubgithub.com/caiqiqi/OpenSSL-HeartBleed-CVE-2014-0160-PoC★ 0githubgithub.com/cved-sources/cve-2014-0160★ 0githubgithub.com/artofscripting-zz/cmty-ssl-heartbleed-CVE-2014-0160-HTTP-HTTPS★ 0githubgithub.com/tomdevman/heartbleed-bug★ 0githubgithub.com/ThanHuuTuan/Heartexploit★ 0githubgithub.com/rouze-d/heartbleed★ 0githubgithub.com/WildfootW/CVE-2014-0160_OpenSSL_1.0.1f_Heartbleed★ 0githubgithub.com/h3x0v3rl0rd/CVE-2014-0160_Heartbleed★ 0githubgithub.com/ArtemCyberLab/Project-Field-Analysis-and-Memory-Leak-Demonstration★ 0githubgithub.com/SimoesCTT/CTT-HEARTBLEED-Temporal-Resonance-Memory-Leak-Exploit-Heartbleed-CVE-2014-0160★ 0githubgithub.com/22imer/CVE-2014-0160★ 0githubgithub.com/0xBlackash/CVE-2014-0160★ 0githubgithub.com/Ryo-Soikutsu/Heartbleed★ 0githubgithub.com/victoriacfigueiredo/heartbleed-lab★ 0githubgithub.com/cbk914/heartbleed-checker★ 0githubgithub.com/MrE-Fog/CVE-2014-0160-Chrome-Plugin★ 0githubgithub.com/timsonner/cve-2014-0160-heartbleed★ 0githubgithub.com/yashfren/CVE-2014-0160-HeartBleed★ 0githubgithub.com/Shayhha/HeartbleedAttack★ 0exploitdbwww.exploit-db.com/exploits/32745unverifiedcve_referencewww.exploit-db.com/exploits/32764unverifiedexploitdbwww.exploit-db.com/exploits/32998unverifiedexploitdbwww.exploit-db.com/exploits/32764unverifiedcve_referencewww.exploit-db.com/exploits/32745unverifiedexploitdbwww.exploit-db.com/exploits/32791unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →References
http://advisories.mageia.org/MGASA-2014-0165.htmlhttp://blog.fox-it.com/2014/04/08/openssl-heartbleed-bug-live-blog/http://cogentdatahub.com/ReleaseNotes.htmlhttp://download.schneider-electric.com/files?p_Doc_Ref=SEVD%202014-119-01http://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=96db9023b881d7cd9f379b0c154650d6c108e9a3http://heartbleed.com/http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131221.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2014-April/131291.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2014-August/136473.htmlhttp://lists.opensuse.org/opensuse-security-announce/2014-04/msg00004.htmlhttp://lists.opensuse.org/opensuse-security-announce/2014-04/msg00005.htmlhttp://lists.opensuse.org/opensuse-updates/2014-04/msg00061.html