CVE-2014-0224 PoC — OpenSSL 加密问题漏洞

Source

https://github.com/Tripwire/OpenSSL-CCS-Inject-Test

Associated Vulnerability

Title:OpenSSL 加密问题漏洞 (CVE-2014-0224)
Description:OpenSSL是OpenSSL团队开发的一个开源的能够实现安全套接层（SSL v2/v3）和安全传输层（TLS v1）协议的通用加密库，它支持多种加密算法，包括对称密码、哈希算法、安全散列算法等。 OpenSSL中存在安全漏洞，该漏洞源于程序没有正确限制ChangeCipherSpec消息的处理。攻击者可借助特制的TLS握手利用该漏洞实施中间人攻击，在OpenSSL-to-OpenSSL通信过程中使用零长度的主密钥，劫持会话或获取敏感消息。以下版本受到影响：OpenSSL 0.9.8y及之前的版本，1.0

Description

This script is designed for detection of vulnerable servers (CVE-2014-0224.)  in a wide range of configurations.  It attempts to negotiate using each affected protocol version (SSLv3, TLSv1, TLSv1.1, and TLSv1.2) advertising a comprehensive set of ciphers.

Readme

OpenSSL CCS Inject Test
=======================

This script is designed for detection of vulnerable servers (CVE-2014-0224.)  in a wide range of configurations.  It attempts to negotiate using each affected protocol version (SSLv3, TLSv1, TLSv1.1, and TLSv1.2) advertising a comprehensive set of ciphers.

Changes:

v0.1 - Updated receive buffer sizes to account for longer certificate messages

v0.2 - Updated record processing to recognize closure alert when included in the same segment as another TLS record

v0.3 - Revised wording to clarify tool output and updated logic to properly recognize session termination outside of standard RFC2246 

This offline tool is not supported and is provided for informational purposes only.
This tool uses Python – license information is available here: http://opensource.org/licenses/Python-2.0

File Snapshot


 [4.0K]  /data/pocs/26f61f598498563fc5f1046696fd6088cf16caf9
├── [ 21K]  OSSL_CCS_InjectTest.py
└── [ 841]  README.md

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!