a vulnerability that exists in the OpenSSL security software, which is used to create secure connections.
Version 1.0.1 of OpenSSL introduced the vulnerability known as heartbleed, and was released on March 14, 2012.
Heartbleed was discovered by Neel Mehta, an engineer at Google Security, and a team of security engineers (Riku, Antti and Matti) at Finnish security firm, Codenomicon.
A computer that is on a secure connection to a server will send out a request to confirm that the connection is still active.
This secure connection (SSL/TSL), is called a “heartbeat.” It includes two things: a payload, and padding.
Servers using the protocol do not check to confirm that the packet of data actually matches the size indicated.
By automatically detecting, blocking and logging attempted Heartbleed attacks, Blue Coat’s SSL Visibility Appliance provides enterprises with the security assurance they require.
So, for example, if a heartbeat was sent with a single byte of data, and claimed to have 30 bytes of data.
Rather than confirm that the data was only 1 byte, the server would grab not only that, but the next 29 bytes from memory as well and send it back the user.