The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library. 
Experts which provide maintenance to OpenSSL library have patched a serious vulnerability (CVE-2014-0160) that allows an attacker to gain the access to 64 KB of memory to any client or server that was connected.
“The Montgomery ladder implementation in OpenSSL through 1.0.0l does not ensure that certain swap operations have a constant-time behavior, which makes it easier for local users to obtain ECDSA nonces via a FLUSH+RELOAD cache side-channel attack,” reports the CVE record for the vulnerability.
The OpenSSL project is managed by a worldwide community of volunteers, which provides support OpenSSL library and related documentation. OpenSSL is the most popular open source cryptographic library and TLS implementation for traffic encryption.
The Heartbleed bug allows anyone on the Internet to read the memory of the systems protected by the vulnerable versions of the OpenSSL software. This compromises the secret keys used to identify the service providers and to encrypt the traffic, the names and passwords of the users and the actual content. This allows attackers to eavesdrop on communications, steal data directly from the services and users and to impersonate services and users.
Why it is called the Heartbleed Bug?
Bug is in the OpenSSL’s implementation of the TLS/DTLS (transport layer security protocols) heartbeat extension (RFC6520). When it is exploited it leads to the leak of memory contents from the server to the client and from the client to the server.
What is being leaked?
Encryption is used to protect secrets that may harm your privacy or security if they leak. In order to coordinate recovery from this bug we have classified the compromised secrets to four categories:
1) primary key material
2) secondary key material
3) protected content
4) collateral
How widespread is this?
Most notable software using OpenSSL are the open source web servers like Apache and nginx. Furthermore OpenSSL is used to protect for example email servers (SMTP, POP and IMAP protocols), chat servers (XMPP protocol), virtual private networks (SSL VPNs), network appliances and wide variety of client side software. Fortunately many large consumer sites are saved by their conservative choice of SSL/TLS termination equipment and software. Ironically smaller and more progressive services or those who have upgraded to latest and best encryption will be affected most. Furthermore OpenSSL is very popular in client software and somewhat popular in networked appliances which have most inertia in getting updates.
What versions of the OpenSSL are affected?
Status of different versions:
- OpenSSL 1.0.1 through 1.0.1f (inclusive) are vulnerable
- OpenSSL 1.0.1g is NOT vulnerable
- OpenSSL 1.0.0 branch is NOT vulnerable
- OpenSSL 0.9.8 branch is NOT vulnerable
Bug was introduced to OpenSSL in December 2011 and has been out in the wild since OpenSSL release 1.0.1 on 14th of March 2012. OpenSSL 1.0.1g released on 7th of April 2014 fixes the bug.
Has my private information been stolen as a result of the bug?
We don’t know. Tests showed that eavesdropping via the bug left no trace.
To make matters worse, the bug-affected code has been used by internet services for more than two years.
Can the bug be fixed?
A fixed version of OpenSSL was released on Monday, April 7. Websites and other services can be secured by using it or by disabling the affected part of the code. Then it needs to be incorporated into their software and the fixed software needs to be installed. That isn’t always easy, especially for certain kinds of devices
How can I protect myself?
a number of sites have have been set up where you can check if the web services you’re using are vulnerable, set up by Italian security researcher Filippo Valsorda.
You might want to stay away from sites identified as “vulnerable” for now.
