4

If I am using a Tor version that is infected with SSL Heartbleed (CVE-2014-0092) Can someone read my hall 2GiB ram? Or is the damage limited to the memory already allocated to the SSL process?

In other words: if I copied sensitive document from Ms Word (CTRL+C) (Now sensitive data is plaintext in RAM), while my system is running vulnerable version of Tor, can a hacker get the sensitive plaintext from the Word allocated memory using the SSL Heartbleed?

2

If no further information is known, you should expect that an attacker can read all your memory. See the heartbleed challenge from Cloudflare as an example. They set up a webserver with a vulnerable version of OpenSSL. Some hours later several persons extracted the key. Fedor Indutny described his work. From his description you can see that he could read random parts of the servers memory. So you should assume that an attacker can read all your memory when you use a vulnerable OpenSSL version.

Furthermore the heartbleed page which was set up by one of the people who found the vulnerability writes:

Without using any privileged information or credentials we were able steal from ourselves the secret keys used for our X.509 certificates, user names and passwords, instant messages, emails and business critical documents and communication.

When OpenSSL allocates memory it takes an area which is not in use by other processes. You can find old data in there and read this out. However the process isolation takes care that a process can't read data from other processes.

  • 1
    Heartbleed can't read memory outside processes in which OpenSSL is used. – CodesInChaos May 1 '14 at 14:09
  • Your references are correct, but the conclusion is wrong. There were only stolen things from within the process that ran OpenSSL. It's not even technically possible for a vulnerability in one process to expose the memory of other processes, unless there is also a vulnerability in the OS. – Jozef Aug 31 '14 at 13:06
0

It's memory allocated to the process that uses the OpenSSL library. Note that in TBB, the browser is not vulnerable itself, but, if I understand correctly, the Onion Proxy could be exploited by a compromised guard.

0

No, you don't need to worry about the rest of the applications, that's what memory space isolation is for in all modern operating systems.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.