CVE-2014-0224 PoC — OpenSSL 加密问题漏洞

Source

https://github.com/ssllabs/openssl-ccs-cve-2014-0224

Associated Vulnerability

Title: OpenSSL 加密问题漏洞 (CVE-2014-0224)
Description:OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessions or obtain sensitive information, via a crafted TLS handshake, aka the "CCS Injection" vulnerability.

Readme

Adam Langley's tool for testing for OpenSSL CVE-2014-0224,
originally published here: https://www.imperialviolet.org/2014/06/05/earlyccs.html

To build the tool:

    $ export GOPATH=$(pwd)
    $ go build openssl-ccs-cve-2014-0224.go

Tested with go 1.2.2 and 1.3.

The src/my-tls directory contains the patched version of the crypto/tls package.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →