vulnerability · 1396828800000

Heartbleed Vulnerability Disclosure

Disclosure of Heartbleed (CVE-2014-0160), a critical vulnerability in the OpenSSL cryptographic software library that allowed attackers to read the memory of vulnerable systems.

What happened

Security researchers discovered a flaw in the OpenSSL implementation of the TLS heartbeat extension. The bug allowed an attacker to read up to 64KB of memory per heartbeat from a vulnerable server or client. This memory could contain private keys, session cookies, and user credentials.

Technical mechanism

A missing bounds check in the handling of the TLS heartbeat extension allowed an attacker to request more data than they submitted, causing the server to return adjacent memory contents.

Why it matters

Heartbleed exposed millions of servers to memory-reading attacks, forcing a massive global effort to patch OpenSSL, revoke and reissue certificates, and raising awareness about the security of critical open-source dependencies.

Impact

An estimated 17% (around half a million) of the internet's secure web servers certified by trusted authorities were believed to be vulnerable to the attack, allowing theft of the servers' private keys and users' session cookies and passwords.

Response

OpenSSL released a patched version (1.0.1g). System administrators worldwide had to urgently patch systems, revoke compromised SSL/TLS certificates, generate new key pairs, and reissue certificates. Users were advised to change passwords.

Defensive lessons

  • Critical open-source infrastructure requires dedicated funding and security audits.
  • Organizations must maintain accurate asset inventories to rapidly identify and patch vulnerable software components.
  • Implementing Perfect Forward Secrecy (PFS) limits the damage of compromised private keys.

Evidence register

  1. Cybersecurity & Infrastructure Security Agency (CISA) — OpenSSL 'Heartbleed' vulnerability (CVE-2014-0160) (verified)