<html><body>
<p> </p>
<blockquote>
<div class="message_header"><span>Tue Apr 08 2014 07:44:00 PM CDT</span><span>from "Mike Miller" <mbmiller+l@gmail.com> </span><span class="message_subject">Subject: Re: [tclug-list] Heartbleed</span></div>
<div class="message_content"><tt>On Tue, 8 Apr 2014, Chris Frederick wrote:</tt><span style="background-color: transparent;">I found this info:<br /></span><span style="background-color: #ffffff; color: #000000;">https://forum.pfsense.org/index.php?topic=74902.msg408806#ms408806</span></div>
</blockquote>
<div class="message_content">I have a Python script (found elsewhere) that you can use to test your pfsense install. I have used it against pfsense firewalls and obtained both the login user name and password in the payload in a pfsense 2.1 firewall (not tested against a pfsense 2.1.1 fw, but they are working on a patch).</div>
<div class="message_content">It was out there for hours, I am sure I am not the only one to wander by and grab a copy</div>
<div class="message_content"> http://s3.jspenguin.org/ssltest.py</div>
<div class="message_content">It is blocked presently, but I did get a copy and it does deliver. Do patch now as the 64 Kb memory exploit does work (and on a limited memory system like a pfsense appliance firewall, it seems to work quite well).</div>
<div class="message_content">pfsense firewalls are great, and I use them, but you need to disable the https access to the login (NOW), and any non patched Openssl based service you have running. Think of ssl wrapper-ed services like pop3, imap, http(s), or vpn's that link to openssl.</div>
<div class="message_content">Good luck citizens! </div>
</body></html>