The Heartbleed vulnerability (CVE-2014-0160) is a critical memory handling flaw in OpenSSL's implementation of the TLS/DTLS heartbeat extension (RFC6520). The bug exists in the dtls1_process_heartbeat() and tls1_process_heartbeat() functions where improper bounds checking allows reading up to 64KB of server memory per request.

/* Vulnerable OpenSSL code snippet */
memcpy(bp, pl, payload);  // Copies payload without proper length validation

Vulnerable versions include:

• OpenSSL 1.0.1 through 1.0.1f
• OpenSSL 1.0.2-beta through 1.0.2-beta1

All operating systems using these versions are affected, including:

- RHEL/CentOS 6.5+ (with OpenSSL 1.0.1e)
- Ubuntu 12.04.4 LTS
- Debian 7 (wheezy)
- FreeBSD 10.0
- OpenBSD 5.3

Manual OpenSSL version check:

openssl version -a
# Safe versions: OpenSSL 1.0.1g+, 1.0.2-beta2+

Automated vulnerability scanning with Nmap:

nmap -sV --script ssl-heartbleed [target] -p 443
# Positive result shows "VULNERABLE"

A proof-of-concept Python script to test for Heartbleed:

import socket
import struct
def heartbleed_test(host, port):
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.connect((host, port))
    # Send Client Hello
    s.send(bytes.fromhex("16 03 01 00 dc 01 00 00 d8 03 01"))
    # ... [truncated for brevity] full POC available on GitHub
    response = s.recv(0xffff)
    return response[20:]  # Contains memory dump if vulnerable

1. Patch OpenSSL:

   sudo apt-get update && sudo apt-get upgrade openssl libssl-dev

2. Reissue SSL certificates:

   openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout new.key -out new.crt

3. Revoke compromised certificates:

   openssl ca -config openssl.cnf -revoke compromised.crt

Check server logs for unusual activity patterns:

grep 'heartbeat' /var/log/nginx/access.log | awk '{print $1}' | sort | uniq -c | sort -nr
# Look for multiple rapid heartbeat requests from single IPs

Monitor for private key leakage in public certificate transparency logs:

openssl x509 -in certificate.pem -text | grep -i "serial\|issuer"
# Compare with Certificate Transparency logs (crt.sh)

Implement these OpenSSL configuration changes in /etc/ssl/openssl.cnf:

[system_default_sect]
MinProtocol = TLSv1.2
CipherString = DEFAULT@SECLEVEL=2
Options = ServerPreference,PrioritizeChaCha

Configure web servers to disable vulnerable protocols:

# Nginx example
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers on;
ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384';

---

The Heartbleed bug (CVE-2014-0160) is a critical vulnerability in OpenSSL's TLS/DTLS heartbeat extension. It allows attackers to read portions of a server's memory, potentially exposing private keys, session cookies, and other sensitive data. The flaw exists in OpenSSL versions 1.0.1 through 1.0.1f.

The vulnerability stems from improper bounds checking in the dtls1_process_heartbeat() function. When processing a maliciously crafted heartbeat request, the server returns up to 64KB of memory contents without proper validation:

/* Vulnerable OpenSSL code snippet */
memcpy(bp, pl, payload);  // Copies attacker-controlled payload without bounds check

• OpenSSL 1.0.1 through 1.0.1f
• Any OS using vulnerable OpenSSL versions (Linux, BSD, Windows servers)
• Services using TLS/DTLS: HTTPS, VPNs, SMTP, IMAP

To check if your server is vulnerable:

# Using openssl command
openssl version -a | grep "OpenSSL 1.0.1[ a-f]"

# Using nmap script
nmap -p 443 --script ssl-heartbleed example.com

1. Upgrade to OpenSSL 1.0.1g or later:

# For Ubuntu/Debian
sudo apt-get update
sudo apt-get install --only-upgrade openssl libssl1.0.0

2. Reissue all SSL certificates
3. Force password resets for all users
4. Revoke and regenerate session tokens

For systems that can't immediately upgrade, consider these workarounds:

# Apache configuration workaround
SSLProtocol All -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
SSLHonorCipherOrder On
SSLCipherSuite "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256"

If you suspect a breach:

1. Analyze server logs for unusual patterns
2. Search for memory dumps in unexpected locations
3. Monitor certificate transparency logs

# Sample Python script to check certificate transparency
import requests
from ct.client import reporter

def check_ct_logs(domain):
    ct_reporter = reporter.CertificateTransparencyReporter()
    return ct_reporter.get_certificates(domain)

• Implement certificate pinning
• Enable OCSP stapling
• Regularly rotate cryptographic keys
• Monitor OpenSSL security announcements