Skip to main content

来个学术贴具体分析一下heartbleed的原理.



发信人: zjn (严禁灌水), 信区: PDA
标  题: 来个学术贴具体分析一下heartbleed的原理.
发信站: BBS 未名空间站 (Fri Apr 11 01:24:17 2014, 美东)

heartbleed的fix在这里:
https://bugzilla.redhat.com/attachment.cgi?id=883475&action=diff#a/ssl/d1_
both.c_sec1

问题出在直接拿了进来的数据包里面的两个字节作为后面memcp
y的长度, 如果一个恶意
的数据包里给个64K作为长度而实际的数据包长度小于64KB, openssl就会把这个数据包
之后的内存内容拷贝发回.

由于用来存数据包的内存是动态分配的, 一般heap实现会将近似大小的动态分配内存放
在一个大的segment中,hacker应当可以读取64KB的和恶意数据包大小近似的动态分配内
存内容. 通过控制数据包长度, 加上知道重要的数据结构的大小, 应当有可能得到非常
重要的内容. 这确实是个十分严重的bug.

十分怀疑这程序员是故意的,这么低级的错误不可能出自一个开发安全协议的程序员手
中. 就好比比一个成人再迷惑也不会不知道1+1=2. 那个是NSA的间谍的怀疑是靠谱的.
http://gengwg.blogspot.com/
Labels:

Comments

Post a Comment

https://gengwg.blogspot.com/

Popular posts from this blog

OWASP Top 10 Threats and Mitigations Exam - Single Select

Last updated 4 Aug 11 Course Title: OWASP Top 10 Threats and Mitigation Exam Questions - Single Select 1) Which of the following consequences is most likely to occur due to an injection attack? Spoofing Cross-site request forgery Denial of service   Correct Insecure direct object references 2) Your application is created using a language that does not support a clear distinction between code and data. Which vulnerability is most likely to occur in your application? Injection   Correct Insecure direct object references Failure to restrict URL access Insufficient transport layer protection 3) Which of the following scenarios is most likely to cause an injection attack? Unvalidated input is embedded in an instruction stream.   Correct Unvalidated input can be distinguished from valid instructions. A Web application does not validate a client’s access to a resource. A Web action performs an operation on behalf of the user without checkin...
2 comments
Read more

CKA Simulator Kubernetes 1.22

  https://killer.sh Pre Setup Once you've gained access to your terminal it might be wise to spend ~1 minute to setup your environment. You could set these: alias k = kubectl                         # will already be pre-configured export do = "--dry-run=client -o yaml"     # k get pod x $do export now = "--force --grace-period 0"   # k delete pod x $now Vim To make vim use 2 spaces for a tab edit ~/.vimrc to contain: set tabstop=2 set expandtab set shiftwidth=2 More setup suggestions are in the tips section .     Question 1 | Contexts Task weight: 1%   You have access to multiple clusters from your main terminal through kubectl contexts. Write all those context names into /opt/course/1/contexts . Next write a command to display the current context into /opt/course/1/context_default_kubectl.sh , the command should use kubectl . Finally write a second command doing the same thing into ...
Post a Comment
Read more