Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Received-SPF: pass (nike.apache.org: domain of h.reindl@thelounge.net
 designates 91.118.73.15 as permitted sender)
Message-ID: <53498580.8000008@thelounge.net>
Date: Sat, 12 Apr 2014 20:27:12 +0200
From: Reindl Harald <h.reindl@thelounge.net>
Organization: the lounge interactive design
User-Agent: Mozilla/5.0 (X11; Linux x86_64;
 rv:24.0) Gecko/20100101 Thunderbird/24.4.0
MIME-Version: 1.0
To: dev@httpd.apache.org
Subject: Re: heartbleed & httpd config leakage
References: <BAY181-W414BD00B7A7B076FACB0BFDC570@phx.gbl>
In-Reply-To: <BAY181-W414BD00B7A7B076FACB0BFDC570@phx.gbl>
OpenPGP: id=7F780279;
	url=http://arrakis.thelounge.net/gpg/h.reindl_thelounge.net.pub.txt
Content-Type: multipart/signed; micalg=pgp-sha1;
 protocol="application/pgp-signature";
 boundary="Db6wQOCaKRQ4VLWKJjNSmlcA7Pb1XwoQU"

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--Db6wQOCaKRQ4VLWKJjNSmlcA7Pb1XwoQU
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable


Am 12.04.2014 20:21, schrieb mi2 co2:
> Hi - I have a question regarding heartbleed and httpd configuration dat=
a leakage. It was suggested that I ask this
> on the dev list as well.
>=20
> Should someone have been exploiting this bug, would it be possible that=
 httpd configuration data, derived via httpd
> confg files and in apache's memory, could have been leaked out through =
these openssl malloc calls? Or is the memory
> space those malloc calls for the openssl encryption/decryption layer is=
olated from the memory where httpd
> configuration is stored?

http://xkcd.com/1354/

it affects the memory of httpd, in doubt any random memory of httpd
whatever critical / sensible data may accessed by httpd have to
be considered no longer to be private

anything else is talking about how likely possible somethings is
there is no proof possible - negative or positive


--Db6wQOCaKRQ4VLWKJjNSmlcA7Pb1XwoQU
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iEYEARECAAYFAlNJhYAACgkQhmBjz394AnmvTgCdGHcxiORMK5RVtSjjwfaXrSby
n48Ani7agTvQZA8XTJxsa0Hh/Qnqs837
=8Su9
-----END PGP SIGNATURE-----

--Db6wQOCaKRQ4VLWKJjNSmlcA7Pb1XwoQU--