Which vulnerability in OpenSSL allowed attackers to read memory of the server or client process?

Which vulnerability in OpenSSL allowed attackers to read memory of the server or client process?

• A. Shellshock
• B. Heartbleed Bug
• C. POODLE
• D. Spectre

Answer: (B)

The vulnerability tests your understanding of memory leakage through a flawed TLS heartbeat in a widely used OpenSSL implementation. Heartbleed allowed an attacker to read memory from the server or client process by sending a heartbeat request with a payload length larger than the actual payload. The server would reply with the requested data plus extra memory from its own process, potentially exposing sensitive information such as private keys, session cookies, usernames, or passwords. This did not require authentication, making it easy to exploit against vulnerable systems. The fix was to update OpenSSL to a version that contains the heartbeat flaw patch and to rotate keys or reissue certificates after patching because private keys could have been compromised. The other options reference distinct issues: Shellshock is a Bash environment-variable vulnerability leading to remote code execution; POODLE targets SSL 3.0 padding and aids decryption but doesn’t involve leaking server process memory; Spectre is a CPU-level speculative execution flaw that can leak memory across processes, not a TLS library vulnerability.

The vulnerability tests your understanding of memory leakage through a flawed TLS heartbeat in a widely used OpenSSL implementation. Heartbleed allowed an attacker to read memory from the server or client process by sending a heartbeat request with a payload length larger than the actual payload. The server would reply with the requested data plus extra memory from its own process, potentially exposing sensitive information such as private keys, session cookies, usernames, or passwords. This did not require authentication, making it easy to exploit against vulnerable systems. The fix was to update OpenSSL to a version that contains the heartbeat flaw patch and to rotate keys or reissue certificates after patching because private keys could have been compromised. The other options reference distinct issues: Shellshock is a Bash environment-variable vulnerability leading to remote code execution; POODLE targets SSL 3.0 padding and aids decryption but doesn’t involve leaking server process memory; Spectre is a CPU-level speculative execution flaw that can leak memory across processes, not a TLS library vulnerability.