nerdexam
EC-Council

312-50V11 · Question #471

Which of the following is a serious vulnerability in the popular OpenSSL cryptographic software library. This weakness allows stealing the information protected, under normal conditions, by the SSL/TL

The correct answer is A. Heartbleed Bug. Heartbleed is a critical buffer over-read vulnerability in OpenSSL that allows attackers to read server memory and steal sensitive data protected by TLS/SSL.

Cryptography

Question

Which of the following is a serious vulnerability in the popular OpenSSL cryptographic software library. This weakness allows stealing the information protected, under normal conditions, by the SSL/TLS encryption used to secure the Internet.

Options

  • AHeartbleed Bug
  • BPOODLE
  • CSSL/TLS Renegotiation Vulnerability
  • DShellshock

How the community answered

(39 responses)
  • A
    90% (35)
  • B
    3% (1)
  • C
    5% (2)
  • D
    3% (1)

Why each option

Heartbleed is a critical buffer over-read vulnerability in OpenSSL that allows attackers to read server memory and steal sensitive data protected by TLS/SSL.

AHeartbleed BugCorrect

Heartbleed (CVE-2014-0160) is a flaw in OpenSSL's implementation of the TLS heartbeat extension that allows an attacker to send a malformed heartbeat request and read up to 64KB of server memory per request, potentially exposing private keys, session tokens, and credentials. It directly targets the OpenSSL library and affects information protected by SSL/TLS encryption, matching the question description exactly.

BPOODLE

POODLE (Padding Oracle On Downgraded Legacy Encryption) is a vulnerability in SSL 3.0 protocol itself that exploits CBC-mode padding, not a flaw in the OpenSSL library's implementation.

CSSL/TLS Renegotiation Vulnerability

The SSL/TLS Renegotiation Vulnerability (CVE-2009-3555) allows attackers to inject plaintext into renegotiated sessions but does not allow reading protected memory or stealing data at rest.

DShellshock

Shellshock (CVE-2014-6271) is a critical vulnerability in the GNU Bash shell, not in the OpenSSL library, and it allows arbitrary code execution via environment variables.

Concept tested: Heartbleed OpenSSL TLS vulnerability identification

Source: https://nvd.nist.gov/vuln/detail/CVE-2014-0160

Topics

#Heartbleed#OpenSSL#SSL/TLS vulnerability#cryptographic flaw

Community Discussion

No community discussion yet for this question.

Full 312-50V11 Practice