full-disclosure - Re: [FD] heartbleed OpenSSL bug CVE-2014-0160

Open Source and information security mailing list archives

Message-ID: <20140411184100.GA9755@hunt>
Date: Fri, 11 Apr 2014 11:41:00 -0700
From: Seth Arnold <seth.arnold@...onical.com>
To: fulldisclosure@...lists.org
Subject: Re: [FD] heartbleed OpenSSL bug CVE-2014-0160

On Fri, Apr 11, 2014 at 01:09:37PM +0200, Reindl Harald wrote:
> interesting, i have until now 3 mail client-IPs triggering that rules on
> 993 and 995 one of them is our own external office, the other two are
> using AppleMail too
> 
> anybody an idea why Mail.app is using Heartbeat packets on POP3s and
> IMAPs?

No idea on pop3.

But a long-lived imap4 connection waiting in IDLE may cause a stateful
firewall (such as common consumer NAT routers) to time-out a connection as
"inactive" after a while. That might result in apparently hung connections
or otherwise unreliable services. TLS heartbeats would be a convenient
way to keep the connection alive through such firewalls and provide a
more reliable service to users.

Thanks

Download attachment "signature.asc" of type "application/pgp-signature" (491 bytes)

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives