312-50V11 · Question #471
Which of the following is a serious vulnerability in the popular OpenSSL cryptographic software library. This weakness allows stealing the information protected, under normal conditions, by the SSL/TL
The correct answer is A. Heartbleed Bug. Heartbleed is a critical buffer over-read vulnerability in OpenSSL that allows attackers to read server memory and steal sensitive data protected by TLS/SSL.
Question
Which of the following is a serious vulnerability in the popular OpenSSL cryptographic software library. This weakness allows stealing the information protected, under normal conditions, by the SSL/TLS encryption used to secure the Internet.
Options
- AHeartbleed Bug
- BPOODLE
- CSSL/TLS Renegotiation Vulnerability
- DShellshock
How the community answered
(39 responses)- A90% (35)
- B3% (1)
- C5% (2)
- D3% (1)
Why each option
Heartbleed is a critical buffer over-read vulnerability in OpenSSL that allows attackers to read server memory and steal sensitive data protected by TLS/SSL.
Heartbleed (CVE-2014-0160) is a flaw in OpenSSL's implementation of the TLS heartbeat extension that allows an attacker to send a malformed heartbeat request and read up to 64KB of server memory per request, potentially exposing private keys, session tokens, and credentials. It directly targets the OpenSSL library and affects information protected by SSL/TLS encryption, matching the question description exactly.
POODLE (Padding Oracle On Downgraded Legacy Encryption) is a vulnerability in SSL 3.0 protocol itself that exploits CBC-mode padding, not a flaw in the OpenSSL library's implementation.
The SSL/TLS Renegotiation Vulnerability (CVE-2009-3555) allows attackers to inject plaintext into renegotiated sessions but does not allow reading protected memory or stealing data at rest.
Shellshock (CVE-2014-6271) is a critical vulnerability in the GNU Bash shell, not in the OpenSSL library, and it allows arbitrary code execution via environment variables.
Concept tested: Heartbleed OpenSSL TLS vulnerability identification
Source: https://nvd.nist.gov/vuln/detail/CVE-2014-0160
Topics
Community Discussion
No community discussion yet for this question.