From owner-freebsd-security@FreeBSD.ORG  Tue Apr  8 13:45:45 2014
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115])
 (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by hub.freebsd.org (Postfix) with ESMTPS id 3CBBC7C7
 for <freebsd-security@freebsd.org>; Tue,  8 Apr 2014 13:45:45 +0000 (UTC)
Received: from smarthost1.sentex.ca (smarthost1.sentex.ca
 [IPv6:2607:f3e0:0:1::12])
 (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
 (Client CN "smarthost.sentex.ca", Issuer "smarthost.sentex.ca" (not verified))
 by mx1.freebsd.org (Postfix) with ESMTPS id 05CFD1319
 for <freebsd-security@freebsd.org>; Tue,  8 Apr 2014 13:45:44 +0000 (UTC)
Received: from [IPv6:2607:f3e0:0:4:f025:8813:7603:7e4a] (saphire3.sentex.ca
 [IPv6:2607:f3e0:0:4:f025:8813:7603:7e4a])
 by smarthost1.sentex.ca (8.14.8/8.14.8) with ESMTP id s38DjZJV024553;
 Tue, 8 Apr 2014 09:45:35 -0400 (EDT) (envelope-from mike@sentex.net)
Message-ID: <5343FD71.6030404@sentex.net>
Date: Tue, 08 Apr 2014 09:45:21 -0400
From: Mike Tancsa <mike@sentex.net>
Organization: Sentex Communications
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64;
 rv:24.0) Gecko/20100101 Thunderbird/24.4.0
MIME-Version: 1.0
To: d@delphij.net, Thomas Steen Rasmussen <thomas@gibfest.dk>,
 freebsd-security@freebsd.org
Subject: Re: http://heartbleed.com/
References: <53430F72.1040307@gibfest.dk> <53431275.4080906@delphij.net>
In-Reply-To: <53431275.4080906@delphij.net>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-Scanned-By: MIMEDefang 2.74
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: "Security issues \[members-only posting\]"
 <freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-security>, 
 <mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security/>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>, 
 <mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 08 Apr 2014 13:45:45 -0000

On 4/7/2014 5:02 PM, Xin Li wrote:
>>
>> The implications of this vulnerability are pretty massive,
>> certificates will need to be replaced and so on. I don't want to
>> repeat the page, so go read that.
>
> We are already working on this but building, reviewing, etc. would
> take some time.
>
> Attached is the minimal fix (extracted from upstream git repository)
> we are intending to use in the advisory for those who want to apply a
> fix now, please DO NOT use any new certificates before applying fixes.

Hi,
	I am trying to understand the implications of this bug in the context 
of a vulnerable client, connecting to a server that does not have this 
extension.  e.g. a client app linked against 1.xx thats vulnerable 
talking to a server that is running something from RELENG_8 in the base 
(0.9.8.x).  Is the server still at risk ? Will the client still bleed 
information ?

	---Mike


-- 
-------------------
Mike Tancsa, tel +1 519 651 3400
Sentex Communications, mike@sentex.net
Providing Internet services since 1994 www.sentex.net
Cambridge, Ontario Canada   http://www.tancsa.com/