> [1]: http://heartbleed.com/ > ... > Some people are claiming that the memory reading ability can read >> arbitrary memory segments and get SSH keys, but I am not convinced. > > > Agreed - if that were true, there would also be a (much more significant) > kernel vulnerability in play as well. > iiic any memory visible to an app that services a port that does SSL handshakes has been vulnerable, eg httpd, perhaps mysql&postgresql, so if you run such apps on exposed ports, your memory has been visible, leaving only the question of whether anybody has been looking at you, which your usual logs won't show, only a comprehensive tcpdump would.. -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://mailman.mn-linux.org/pipermail/tclug-list/attachments/20140408/b4b2f19f/attachment.html>