Menu
"OpenSSL 1.01 — the one production version affected — had been shipping since March 12, 2012"
Does this (above) mean that a Windows 2012 R2 server we ordered a month ago, now running HTTPS sites in IIS, is vulnerable to Heartbleed attacks?
I've read a post that suggests checking if your server is vulnerable, by using this site http://filippo.io/Heartbleed/ , but it's probably taking a ton of hits right now, as it's not responding.
651
A Netcraft study indicated that 17% of SSL servers (approximately 500,000 servers) were vulnerable to Heartbleed.
What is the impact of Heartbleed? The Heartbleed bug allows anyone on the internet to read the memory of the systems protected by the vulnerable versions of the OpenSSL software.
The Heartbleed vulnerability was discovered and fixed in 2014, yet today—five years later—there are still unpatched systems. The Heartbleed vulnerability was introduced into the OpenSSL crypto library in 2012. It was discovered and fixed in 2014, yet today—five years later—there are still unpatched systems.
IIS is not vulnerable as it does not use the OpenSSL library
Update, quote Troy Hunt:
Not all web servers are dependent on OpenSSL. IIS, for example, uses Microsoft’s SChannel implementation which is not at risk of this bug. Does that mean that sites on IIS are not vulnerable to Heartbleed? For the most part, yes, but don’t get too cocky because OpenSSL may still be present within the server farm.
More info here - http://www.troyhunt.com/2014/04/everything-you-need-to-know-about.html
Update 2:
Microsoft blog post on IIS and Heartbleed: http://blogs.technet.com/b/erezs_iis_blog/archive/2014/04/09/information-about-heartbleed-and-iis.aspx
123
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
