TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

OpenSSL SSL3_AL_WARNING undefined alert remote DoS

79 点作者 attilagyorffy超过 8 年前

5 条评论

user5994461超过 8 年前
&gt; An attacker could repeat the undefined plaintext warning packets of &quot;SSL3_AL_WARNING&quot; during the handshake, which will easily make to consume 100% CPU on the server.<p>&gt; It is an implementation problem in OpenSSL that OpenSSL would ignore undefined warning, and continue dealing with the remaining data(if exist). So the attacker could pack multiple alerts inside a single record and send a large number of there large records. Then the server will be fallen in a meaningless cycle, and not available to any others.<p>SSL3 is vulnerable and should be banned in the webserver&#x27;s configuration. It stopped being supported by major browsers years ago.<p>The article doesn&#x27;t say if webservers are vulnerable when they block SSL3 entirely. If so, it&#x27;s the hell of a critical vulnerability! Otherwise, <a href="http:&#x2F;&#x2F;disablessl3.com&#x2F;" rel="nofollow">http:&#x2F;&#x2F;disablessl3.com&#x2F;</a>
评论 #12780061 未加载
评论 #12780013 未加载
kfreds超过 8 年前
&quot;All versions (SSL3.0, TLS1.0, TLS1.1, TLS1.2) are affected.&quot; according to <a href="http:&#x2F;&#x2F;security.360.cn&#x2F;cve&#x2F;CVE-2016-8610&#x2F;" rel="nofollow">http:&#x2F;&#x2F;security.360.cn&#x2F;cve&#x2F;CVE-2016-8610&#x2F;</a><p>It would be helpful if the researchers clarified how potent this DoS attack vector is. Is sending &quot;a large number of these large records&quot; more efficient at denying availability than a naive flood using e.g. SYNs or UDP?
评论 #12780279 未加载
duskwuff超过 8 年前
This seems like a pretty... weak vulnerability.<p>Sure -- you can send an SSL server a bunch of junk data, and it&#x27;ll try to process that data. But from what I gather, it&#x27;s not as though it takes an unusually long time for it to process these warnings either. Any attacker with the resources to perform this attack could probably just as easily saturate the host&#x27;s network connection without involving SSL at all.
评论 #12779877 未加载
attilagyorffy超过 8 年前
there&#x27;s currently no post on openssl.org but i expect them to publish one soon. Also, now with all the OpenSSL sh*tstorm this year, I really wonder if LibreSSL is vulnerable to this security problem...
评论 #12779457 未加载
cyg07超过 8 年前
so far nginx is the only server which is affected by this issue, but the latest version wasnt affected.