CVE-2014-0224 PoC — OpenSSL 加密问题漏洞

Source

https://github.com/ssllabs/openssl-ccs-cve-2014-0224

Associated Vulnerability

Title:OpenSSL 加密问题漏洞 (CVE-2014-0224)
Description:OpenSSL是OpenSSL团队开发的一个开源的能够实现安全套接层（SSL v2/v3）和安全传输层（TLS v1）协议的通用加密库，它支持多种加密算法，包括对称密码、哈希算法、安全散列算法等。 OpenSSL中存在安全漏洞，该漏洞源于程序没有正确限制ChangeCipherSpec消息的处理。攻击者可借助特制的TLS握手利用该漏洞实施中间人攻击，在OpenSSL-to-OpenSSL通信过程中使用零长度的主密钥，劫持会话或获取敏感消息。以下版本受到影响：OpenSSL 0.9.8y及之前的版本，1.0

Readme

Adam Langley's tool for testing for OpenSSL CVE-2014-0224,
originally published here: https://www.imperialviolet.org/2014/06/05/earlyccs.html

To build the tool:

    $ export GOPATH=$(pwd)
    $ go build openssl-ccs-cve-2014-0224.go

Tested with go 1.2.2 and 1.3.

The src/my-tls directory contains the patched version of the crypto/tls package.

File Snapshot


 [4.0K]  /data/pocs/931e1b1639aa906d35be16503360ccbdd230d122
├── [3.3K]  earlyccs_tls.patch
├── [1.4K]  LICENSE
├── [2.6K]  openssl-ccs-cve-2014-0224.go
├── [ 347]  README.md
└── [4.0K]  src
    └── [4.0K]  my-tls
        ├── [2.5K]  alert.go
        ├── [9.1K]  cipher_suites.go
        ├── [ 17K]  common.go
        ├── [ 13K]  common.go.orig
        ├── [ 28K]  conn.go
        ├── [ 26K]  conn.go.orig
        ├── [5.3K]  conn_test.go
        ├── [2.2K]  example_test.go
        ├── [3.0K]  generate_cert.go
        ├── [ 17K]  handshake_client.go
        ├── [ 11K]  handshake_client.go.orig
        ├── [3.5K]  handshake_client.go.rej
        ├── [ 12K]  handshake_client_test.go
        ├── [ 28K]  handshake_messages.go
        ├── [6.1K]  handshake_messages_test.go
        ├── [ 18K]  handshake_server.go
        ├── [ 25K]  handshake_server_test.go
        ├── [4.2K]  handshake_test.go
        ├── [ 12K]  key_agreement.go
        ├── [8.2K]  prf.go
        ├── [4.9K]  prf_test.go
        ├── [4.1K]  ticket.go
        ├── [7.5K]  tls.go
        └── [7.1K]  tls_test.go

2 directories, 28 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!