Heartbleed: Please change your passwords of affected sites

[zzm9980]

@zzm - is it really a buffer overrun exploit? I thought these kinds of things would have been patched up years ago.

Technically it just reads too much without modifying anything in memory. Buffer overflow writes over some data often to execute specific tasks.

It's really the same difference, though, isn't it. Any given data field that has been malloc'ed contains the length of the field. Anything asking for more, could, and should be rejected. Seems like a big coding oversight.

OpenSSL thought they knew better and didn't use protections built into malloc.

http://article.gmane.org/gmane.os.openbsd.misc/211963

[Strong Eagle]

Technically it just reads too much without modifying anything in memory. Buffer overflow writes over some data often to execute specific tasks.

It's really the same difference, though, isn't it. Any given data field that has been malloc'ed contains the length of the field. Anything asking for more, could, and should be rejected. Seems like a big coding oversight.

OpenSSL thought they knew better and didn't use protections built into malloc.

http://article.gmane.org/gmane.os.openbsd.misc/211963

Wow... something that fundamental.