• openssl漏洞检查修复

    漏洞发现

    1. [root@localhost Git]# nmap -sV --script ssl-enum-ciphers -p 8888 x.x.x.x
    2. Starting Nmap 6.40 ( http://nmap.org ) at 2022-09-14 21:52 CST
    3. Stats: 0:01:13 elapsed; 0 hosts completed (1 up), 1 undergoing Service Scan
    4. Service scan Timing: About 0.00% done
    5. Nmap scan report for x.x.x.x
    6. Host is up (0.047s latency).
    7. PORT     STATE SERVICE    VERSION
    8. 8888/tcp open  ssl/abyss?
    9. | ssl-enum-ciphers: 
    10. |   SSLv3: 
    11. |     ciphers: 
    12. |       TLS_RSA_WITH_3DES_EDE_CBC_SHA - strong
    13. |       TLS_RSA_WITH_AES_128_CBC_SHA - strong
    14. |       TLS_RSA_WITH_AES_256_CBC_SHA - strong
    15. |       TLS_RSA_WITH_CAMELLIA_128_CBC_SHA - strong
    16. |       TLS_RSA_WITH_CAMELLIA_256_CBC_SHA - strong
    17. |       TLS_RSA_WITH_IDEA_CBC_SHA - weak
    18. |       TLS_RSA_WITH_RC4_128_MD5 - strong
    19. |       TLS_RSA_WITH_RC4_128_SHA - strong
    20. |       TLS_RSA_WITH_SEED_CBC_SHA - strong
    21. |     compressors: 
    22. |       NULL
    23. |   TLSv1.0: 
    24. |     ciphers: 
    25. |       TLS_RSA_WITH_3DES_EDE_CBC_SHA - strong
    26. |       TLS_RSA_WITH_AES_128_CBC_SHA - strong
    27. |       TLS_RSA_WITH_AES_256_CBC_SHA - strong
    28. |       TLS_RSA_WITH_CAMELLIA_128_CBC_SHA - strong
    29. |       TLS_RSA_WITH_CAMELLIA_256_CBC_SHA - strong
    30. |       TLS_RSA_WITH_IDEA_CBC_SHA - weak
    31. |       TLS_RSA_WITH_RC4_128_MD5 - strong
    32. |       TLS_RSA_WITH_RC4_128_SHA - strong
    33. |       TLS_RSA_WITH_SEED_CBC_SHA - strong
    34. |     compressors: 
    35. |       NULL
    36. |   TLSv1.1: 
    37. |     ciphers: 
    38. |       TLS_RSA_WITH_3DES_EDE_CBC_SHA - strong
    39. |       TLS_RSA_WITH_AES_128_CBC_SHA - strong
    40. |       TLS_RSA_WITH_AES_256_CBC_SHA - strong
    41. |       TLS_RSA_WITH_CAMELLIA_128_CBC_SHA - strong
    42. |       TLS_RSA_WITH_CAMELLIA_256_CBC_SHA - strong
    43. |       TLS_RSA_WITH_IDEA_CBC_SHA - weak
    44. |       TLS_RSA_WITH_RC4_128_MD5 - strong
    45. |       TLS_RSA_WITH_RC4_128_SHA - strong
    46. |       TLS_RSA_WITH_SEED_CBC_SHA - strong
    47. |     compressors: 
    48. |       NULL
    49. |   TLSv1.2: 
    50. |     ciphers: 
    51. |       TLS_RSA_WITH_3DES_EDE_CBC_SHA - strong
    52. |       TLS_RSA_WITH_AES_128_CBC_SHA - strong
    53. |       TLS_RSA_WITH_AES_128_CBC_SHA256 - strong
    54. |       TLS_RSA_WITH_AES_128_GCM_SHA256 - strong
    55. |       TLS_RSA_WITH_AES_256_CBC_SHA - strong
    56. |       TLS_RSA_WITH_AES_256_CBC_SHA256 - strong
    57. |       TLS_RSA_WITH_AES_256_GCM_SHA384 - strong
    58. |       TLS_RSA_WITH_CAMELLIA_128_CBC_SHA - strong
    59. |       TLS_RSA_WITH_CAMELLIA_256_CBC_SHA - strong
    60. |       TLS_RSA_WITH_IDEA_CBC_SHA - weak
    61. |       TLS_RSA_WITH_RC4_128_MD5 - strong
    62. |       TLS_RSA_WITH_RC4_128_SHA - strong
    63. |       TLS_RSA_WITH_SEED_CBC_SHA - strong
    64. |     compressors: 
    65. |       NULL
    66. |_  least strength: weak
    67.  
    68. Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
    69. Nmap done: 1 IP address (1 host up) scanned in 160.05 seconds

    漏洞描述
    TLS, SSH, IPSec协商及其他产品中使用的IDEA、DES及Triple DES密码或者3DES及Triple 3DES存在大约四十亿块的生日界，这可使远程攻击者通过Sweet32攻击，获取纯文本数据。
    TLS是安全传输层协议，用于在两个通信应用程序之间提供保密性和数据完整性。

    <*来源：Karthik Bhargavan Gaetan Leurent
    链接：https://www.openssl.org/news/secadv/20160922.txt
    *>

    漏洞解决
    重点：避免使用IDEA、DES和3DES算法
    1、OpenSSL Security Advisory [22 Sep 2016]
    链接：https://www.openssl.org/news/secadv/20160922.txt
    请在下列网页下载最新版本：  
    https://www.openssl.org/source/
    2、对于nginx、apache、lighttpd等服务器禁止使用DES加密算法 
    主要是修改conf文件
    3、Windows系统可以参考如下链接：
    https://social.technet.microsoft.com/Forums/en-US/31b3ba6f-d0e6-417a-b6f1-d0103f054f8d/ssl-medium-strength-cipher-suites-supported-sweet32cve20162183?forum=ws2016
    https://docs.microsoft.com/zh-cn/troubleshoot/windows-server/windows-security/restrict-cryptographic-algorithms-protocols-schannel

    4、如果是tcp+ssl(tcp服务端然后用ssl加密数据流)服务端，这时候我们调用的是openssl.so的库函数对数据进行加解密，同样可以指定加密算法套件，这里只列出关键代码：

    1.     ctx = SSL_CTX_new(TLSv1_2_server_method());
    2.  
    3.     if (!SSL_CTX_set_cipher_list(ctx, "RSA+AES")) {
    4. 		Log("error in cipher list");
    5.         goto err_ssl;
    6.     }

    漏洞验证

    1. [root@localhost GitHub]# nmap -sV --script ssl-enum-ciphers -p 8888 x.x.x.x
    2.  
    3. Starting Nmap 6.40 ( http://nmap.org ) at 2022-09-14 21:42 CST
    4. Stats: 0:01:48 elapsed; 0 hosts completed (1 up), 1 undergoing Service Scan
    5. Service scan Timing: About 0.00% done
    6. Nmap scan report for x.x.x.x
    7. Host is up (0.044s latency).
    8. PORT     STATE SERVICE    VERSION
    9. 8888/tcp open  ssl/abyss?
    10. | ssl-enum-ciphers: 
    11. |   SSLv3: No supported ciphers found
    12. |   TLSv1.2: 
    13. |     ciphers: 
    14. |       TLS_RSA_WITH_AES_128_CBC_SHA - strong
    15. |       TLS_RSA_WITH_AES_128_CBC_SHA256 - strong
    16. |       TLS_RSA_WITH_AES_128_GCM_SHA256 - strong
    17. |       TLS_RSA_WITH_AES_256_CBC_SHA - strong
    18. |       TLS_RSA_WITH_AES_256_CBC_SHA256 - strong
    19. |       TLS_RSA_WITH_AES_256_GCM_SHA384 - strong
    20. |     compressors: 
    21. |       NULL
    22. |_  least strength: strong
    23.  
    24. Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
    25. Nmap done: 1 IP address (1 host up) scanned in 150.03 seconds

    检查ssh

    登陆本机检查ssh使用的所有加密套件

    1. [root@ii bin]# ssh -Q cipher
    2. 3des-cbc
    3. blowfish-cbc
    4. cast128-cbc
    5. arcfour
    6. arcfour128
    7. arcfour256
    8. aes128-cbc
    9. aes192-cbc
    10. aes256-cbc
    11. rijndael-cbc@lysator.liu.se
    12. aes128-ctr
    13. aes192-ctr
    14. aes256-ctr
    15. aes128-gcm@openssh.com
    16. aes256-gcm@openssh.com
    17. chacha20-poly1305@openssh.com

    远程通过nmap扫ssh开启的加密套件 

    1. [root@localhost xxx]# nmap --script ssh2-enum-algos -sV -p 22 xxx.xxx.xxx.xxx
    2. Starting Nmap 6.40 ( http://nmap.org ) at 2022-10-08 10:17 CST
    3. Nmap scan report for 8.140.187.195
    4. Host is up (0.037s latency).
    5. PORT     STATE SERVICE VERSION
    6. 9990/tcp open  ssh     OpenSSH 7.4 (protocol 2.0)
    7. | ssh2-enum-algos: 
    8. |   kex_algorithms (12)
    9. |       curve25519-sha256
    10. |       curve25519-sha256@libssh.org
    11. |       ecdh-sha2-nistp256
    12. |       ecdh-sha2-nistp384
    13. |       ecdh-sha2-nistp521
    14. |       diffie-hellman-group-exchange-sha256
    15. |       diffie-hellman-group16-sha512
    16. |       diffie-hellman-group18-sha512
    17. |       diffie-hellman-group-exchange-sha1
    18. |       diffie-hellman-group14-sha256
    19. |       diffie-hellman-group14-sha1
    20. |       diffie-hellman-group1-sha1
    21. |   server_host_key_algorithms (5)
    22. |       ssh-rsa
    23. |       rsa-sha2-512
    24. |       rsa-sha2-256
    25. |       ecdsa-sha2-nistp256
    26. |       ssh-ed25519
    27. |   encryption_algorithms (12)
    28. |       chacha20-poly1305@openssh.com
    29. |       aes128-ctr
    30. |       aes192-ctr
    31. |       aes256-ctr
    32. |       aes128-gcm@openssh.com
    33. |       aes256-gcm@openssh.com
    34. |       aes128-cbc
    35. |       aes192-cbc
    36. |       aes256-cbc
    37. |       blowfish-cbc
    38. |       cast128-cbc
    39. |       3des-cbc
    40. |   mac_algorithms (10)
    41. |       umac-64-etm@openssh.com
    42. |       umac-128-etm@openssh.com
    43. |       hmac-sha2-256-etm@openssh.com
    44. |       hmac-sha2-512-etm@openssh.com
    45. |       hmac-sha1-etm@openssh.com
    46. |       umac-64@openssh.com
    47. |       umac-128@openssh.com
    48. |       hmac-sha2-256
    49. |       hmac-sha2-512
    50. |       hmac-sha1
    51. |   compression_algorithms (2)
    52. |       none
    53. |_      zlib@openssh.com
    54.  
    55. Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
    56. Nmap done: 1 IP address (1 host up) scanned in 1.10 seconds

    修改ssh配置

    报错

    -- Unit sshd.service has begun starting up.
    Oct 08 10:37:08 xxx sshd[10523]: /etc/ssh/sshd_config line 41: Deprecated option RSAAuthentication
    Oct 08 10:37:08 xxx sshd[10523]: /etc/ssh/sshd_config line 178: Directive 'Ciphers' is not allowed within a Match block
    Oct 08 10:37:08 xxx systemd[1]: sshd.service: main process exited, code=exited, status=255/n/a
    Oct 08 10:37:08 xxx systemd[1]: Failed to start OpenSSH server daemon.

    1. [root@xxx bin]# vim /etc/ssh/sshd_config
    2. #如果ssh中sftp配置过下面两句，需要将ssh相关配置放在这两句之前
    3. Ciphers aes128-ctr,aes192-ctr,aes256-ctr
    4.  
    5. Subsystem sftp internal-sftp
    6. Match Group sftp

    参考

    CVE-2016-2183 修复过程，亲测有效 - SegmentFault 思否

    修复DES和Triple DES 信息泄露漏洞(CVE-2016-2183) | 易学教程

  • 相关阅读:
    D. Divide and Equalize--Codeforces Round 903 (Div. 3)
    动作捕捉系统通过SDK与MATLAB/Simulink通信
    IP地址查询和代理服务器：双重保护隐私
    小黑子—spring：第一章 Bean基础
    【Pytorch实用教程】nn.LogSoftmax的详细用法及公式
    golang的channel探索
    Rider 中C#单元测试
    微服务容器部署与持续集成（Jenkins）
    进程（软件）
    数据异常值检测
  • 原文地址：https://blog.csdn.net/MEIYOUDAO_JIUSHIDAO/article/details/126861588