OpenSSL Heartbeat Information Disclosure (Heartbleed)

This script is Copyright (C) 2014-2015 Tenable Network Security, Inc.

Synopsis :

The remote service is affected by an information disclosure

Description :

Based on its response to a TLS request with a specially crafted
heartbeat message (RFC 6520), the remote service appears to be
affected by an out-of-bounds read flaw.

This flaw could allow a remote attacker to read the contents of up to
64KB of server memory, potentially exposing passwords, private keys,
and other sensitive data.

See also :

Solution :

Upgrade to OpenSSL 1.0.1g or later.

Alternatively, recompile OpenSSL with the '-DOPENSSL_NO_HEARTBEATS'
flag to disable the vulnerable functionality.

Risk factor :

High / CVSS Base Score : 9.4
CVSS Temporal Score : 8.2
Public Exploit Available : true

Family: Misc.

Nessus Plugin ID: 73412 ()

Bugtraq ID: 66690

CVE ID: CVE-2014-0160