OK so unless you have been living in a hole you have probably heard about an OpenSSL exploit called Heartbleed. It is so named because it relates to TLS heartbeat functionality of some kind.
I've been reading about this on Bruce Schneier's blog, on linuxquestions.org, etc. Unless I'm mistaken, it would seem to be a problem with one's web server and possibly email or instant messaging but not with ssh (?) Can someone confirm that SSH is not vulnerable?
I think the basic idea is that the bug lets one formulate a special request to a vulnerable machine and it will spit out a section of memory. I think, but am not certain, that the result would be access to the memory allocated to the vulnerable processes but not memory allocated to the system, to the root user, or to the other users on that machine (I'm talking linux here). I.e, I think you might get a segfault if you try to read memory that is out of bounds -- i.e., memory owned by some other user. My memory is really fuzzy on this point so I'd love to hear what someone else has to say.
Also, I'm wondering if these sites everyone is reocmmending look safe. E.g., heartbleed.com or the tester site recommended by Schneier ( http://filippo.io/Heartbleed/ ). The heartbleed.com site belongs to some Finnish dude.
Also, any mitigation/protection recommendations would be appreciated. Obviously these
1) patch the vulnerability
2) retire your SSL cert on your web server and issue a new one
But I'm wondering if a) the machine might have been compromised before somehow (e.g., if website passwords are also used as ssh passwords) and b) What else might one need to do?
