CVE-2014-0224 PoC — OpenSSL 加密问题漏洞

Source

https://github.com/Tripwire/OpenSSL-CCS-Inject-Test

Associated Vulnerability

Title:OpenSSL 加密问题漏洞 (CVE-2014-0224)
Description:OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessions or obtain sensitive information, via a crafted TLS handshake, aka the "CCS Injection" vulnerability.

Description

This script is designed for detection of vulnerable servers (CVE-2014-0224.)  in a wide range of configurations.  It attempts to negotiate using each affected protocol version (SSLv3, TLSv1, TLSv1.1, and TLSv1.2) advertising a comprehensive set of ciphers.

Readme

OpenSSL CCS Inject Test
=======================

This script is designed for detection of vulnerable servers (CVE-2014-0224.)  in a wide range of configurations.  It attempts to negotiate using each affected protocol version (SSLv3, TLSv1, TLSv1.1, and TLSv1.2) advertising a comprehensive set of ciphers.

Changes:

v0.1 - Updated receive buffer sizes to account for longer certificate messages

v0.2 - Updated record processing to recognize closure alert when included in the same segment as another TLS record

v0.3 - Revised wording to clarify tool output and updated logic to properly recognize session termination outside of standard RFC2246 

This offline tool is not supported and is provided for informational purposes only.
This tool uses Python – license information is available here: http://opensource.org/licenses/Python-2.0

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!