Re: Heartbleed vulnerability OpenSSL

There are already a few sites up that test for the heartbeat extension and also try to actively exploit it if it's enabled:

http://possible.lv/tools/hb/

http://filippo.io/Heartbleed/

https://www.ssllabs.com/ssltest/

I can confirm that they successfully detect a vulnerable Linux host.

If anyone happens to have or temporarily arrange for internet-facing hosts/vCenters/other vSphere products, they should give it a try.

Edit:

https://github.com/justfalter/heartbleed/blob/master/jared_stafford/heartbleed.py

Tested the above script against a 5.5 host and it reports vulnerable as expected, while <5.5 does not.