Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Is there a way to tell if a third-party site has patched the bug? (Upgraded to 1.0.1g) Not much point in changing your password on that site before the vulnerability is fixed.


Someone wrote this: http://filippo.io/Heartbleed/


echo -e "quit\n" | openssl s_client -connect <HOSTNAME>:443 -tlsextdebug 2>&1| [ "` grep -c 'TLS server extension \"heartbeat\" (id=15), len=1'`" -gt 0 ] && echo 'Vulnerable'


That can false-positive, for what it's worth, in servers with fixed TLS heartbeats (instead of removing them).




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: