OpenSSL HeartBleed漏洞自动化检测工具设计与实现  

Design and implementation of automated detection tool for openssl heartbleed vulnerability

作　　者：陈希 胡峻洁 张亮 严义兵 雷敏 Chen Xi;Hu Jun-jie;Zhang Liang;Yan Yi-bing;Lei Min1(School of Cyberspace Security, Beijing University of Posts and Telecommunications, Beijing 100876;National Engineering Laboratory for Disaster Recovery Technology, Beijing 100876;Sichuan Kerui Software Co., Ltd., SichuanMianyang 621000)

机构地区：[1]北京邮电大学网络空间安全学院,北京100876 [2]灾备技术国家工程实验室,北京100876 [3]四川科瑞软件有限责任公司,四川绵阳621000

出　　处：《网络空间安全》2018年第1期74-78,共5页Cyberspace Security

摘　　要：OpenSSL在实现心跳逻辑时,存在编码上的缺陷,导致了HeartBleed漏洞的发生。由于在没有正确执行边界检查的前提下,就执行memcpy()函数调用受害用户输入内容作为长度参数,使得攻击者可以利用该漏洞远程读取存在漏洞版本的OpenSSL服务器内存中多达64KB的数据。论文文通过分析OpenSSL的工作原理,阐明了HeartBleed漏洞产生的根本原因;设计并实现自动化检测工具,判断服务器是否存在该漏洞,并在实际测试中被成功应用。Heartbeat logic in OpenSSL has a code flaw,leading to the occurrence of HeartBleed vulnerability.The execution of the memcpy()function invokes the victim user input content as a length parameter without the proper execution of the boundary check,allowing the attacker to remotely read up to64KB of data in the OpenSSL server memory where the vulnerability exists.This paper analyzes the principle of OpenSSL and clarifies the root cause of the HeartBleed vulnerability.On this basis,this paper designs and implements the automated detection tool which is successfully applied in the actual test to judge whether the server exists the vulnerability.

关 键 词：OPENSSL HeartBleed漏洞 自动化检测 

分 类 号：TP312[自动化与计算机技术—计算机软件与理论]