CVE-2014-0224 PoC — OpenSSL 加密问题漏洞

Source

Associated Vulnerability

Title: OpenSSL 加密问题漏洞 (CVE-2014-0224)
Description:OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessions or obtain sensitive information, via a crafted TLS handshake, aka the "CCS Injection" vulnerability.

Description

Used for evaluating hosts for CVE-2014-0224

Readme

Evaluates hosts for CVE-2014-0224 vulnerability
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0224

Usage:

>ccs-eval.py list-of-hosts.txt

-Takes in a list of hosts, line seperated. Checks the host for common SSL ports using 
nmap. Peforms PoC injection test supplied by RedHat (fake-client-early-ccs.pl). Writes 
results to "local-results-list-of-hosts.txt"

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →