关联漏洞
标题：
OpenSSL 缓冲区错误漏洞
(CVE-2014-0160)
描述：OpenSSL是OpenSSL团队开发的一个开源的能够实现安全套接层（SSL v2/v3）和安全传输层（TLS v1）协议的通用加密库，它支持多种加密算法，包括对称密码、哈希算法、安全散列算法等。 OpenSSL的TLS和DTLS实现过程中的d1_both.c和t1_lib.c文件中存在安全漏洞，该漏洞源于当处理Heartbeat Extension数据包时，缺少边界检查。远程攻击者可借助特制的数据包利用该漏洞读取服务器内存中的敏感信息(如用户名、密码、Cookie、私钥等)。以下版本的OpenSSL受到
描述
OpenSSL Heartbleed (CVE-2014-0160) Fix script
介绍
openssl-heartbleed-fix
======================
OpenSSL Heartbleed (CVE-2014-0160) Fix script
Sammy Fung <sammy@sammy.hk>
OpenSSL Heartbleed ([CVE-2014-0160] (http://www.us-cert.gov/ncas/alerts/TA14-098A)) bug is now discovered by network security professionals, which many systems using some OpenSSL versions are affected.
In theory, it is assumed that SSL certificates on many web servers are affected, so it is also suggested to generate a new SSL certificate with fixed version of OpenSSL.
To summerize the fix procedure, we should upgrade OpenSSL with apt-get or yum on Linux systems, and then we should confirm build date of OpenSSL is 2014/4/7 or later.
$ apt-get update && apt-get install -y libssl1.0.0 openssl
And then generate a new SSL certificate for Apache HTTP web server, after that we restart Apache httpd to get it done.
$ openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/ssl/private/ssl-cert-snakeoil.key -out /etc/ssl/certs/ssl-cert-snakeoil.pem
It is not as simple as normal bugfix, so you are suggested to read the following blog posts (English and Chinese).
A shell script openssl-heartbleed-fix.sh is written according to my English detail blog post to this bug. You can download this git repo or the shell script, read the code and run it if you understand what the script do.
Enquiry and Support
-------------------
For any questsions, you can contact with me.
Blog
----
* [Fixing Linux Systems with OpenSSL Heartbleed (CVE-2014-0160)] (http://www.linuxharbour.com/fixing-linux-systems-with-openssl-heartbleed-cve-2014-0160/)
* [OpenSSL Heartbleed (CVE-2014-0160) 解決方法] (http://sammy.hk/openssl-heartbleed-cve-2014-0160-solution/)
文件快照
[4.0K] /data/pocs/fca29196ab70790f62425fb1f62366c15a81b38c
├── [ 18K] LICENSE
├── [1.2K] openssl-heartbleed-fix.sh
└── [1.7K] README.md
0 directories, 3 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。