Windows Server 2012 R2 and IIS affected by Heartbleed exploit? [closed]

IIS is not vulnerable as it does not use the OpenSSL library

Update, quote Troy Hunt:

Not all web servers are dependent on OpenSSL. IIS, for example, uses Microsoft’s SChannel implementation which is not at risk of this bug. Does that mean that sites on IIS are not vulnerable to Heartbleed? For the most part, yes, but don’t get too cocky because OpenSSL may still be present within the server farm.

More info here –

Update 2:

Microsoft blog post on IIS and Heartbleed:

Leave a Comment