Poodle nres ua haujlwm li cas?
Poodle nres ua haujlwm li cas?

Video: Poodle nres ua haujlwm li cas?

Video: Poodle nres ua haujlwm li cas?
Video: khwv nyiaj tsis nce tes yog vim li cas 2024, Plaub Hlis Ntuj
Anonim

POODLE yog ib tug neeg hauv nruab nrab nres uas yuam cov neeg siv khoom niaj hnub (browsers) thiab servers (websites) kom txo qis cov txheej txheem kev nyab xeeb rau SSLv3 los ntawm TLSv1. 0 los yog siab dua. Qhov no yog ua los ntawm kev cuam tshuam kev sib koom tes ntawm tus neeg siv khoom thiab cov neeg rau zaub mov; ua rau rov sim dua ntawm kev sib tuav tes nrog cov txheej txheem ua ntej.

Raws li, puas poodles tua?

POODLE nres tawm tsam TLS Txawm hais tias TLS cov lus qhia tshwj xeeb xav tau cov servers los tshawb xyuas cov padding, qee qhov kev siv tsis tau lees paub nws zoo, uas ua rau qee cov servers muaj kev cuam tshuam. POODLE txawm tias lawv lov tes taw SSL 3.0.

Ib yam li ntawd, Zombie poodle yog dab tsi? Zombie POODLE yog ib qho ntawm ntau TLS CBC padding oracles Tripwire IP360 kuaj pom. Cov kab ke cuam tshuam yuav raug tshaj tawm raws li ID #415753, "TLS CBC Padding Oracle Vulnerability". Citrix thiab F5 tau tshaj tawm cov lus qhia thiab cov lus qhia tom ntej tau taug qab ntawm GitHub.

Hauv qhov no, yuav ua li cas kho qhov tsis zoo ntawm lub poodle?

  1. Disable SSL 3.0 kev txhawb nqa hauv tus neeg siv khoom.
  2. Disable SSL 3.0 kev txhawb nqa hauv lub server.
  3. Tshem tawm kev txhawb nqa rau CBC-based cipher suites thaum siv SSL 3.0 (hauv cov neeg siv khoom lossis server).

Heartbleed attack yog dab tsi?

Cov Heartbleed Kab laum yog qhov muaj qhov tsis zoo nyob hauv lub tsev qiv ntawv nrov OpenSSL cryptographic software. Qhov tsis muaj zog no tso cai rau nyiag cov ntaub ntawv tiv thaiv, raws li ib txwm muaj, los ntawm SSL / TLS encryption siv los tiv thaiv Is Taws Nem.

Pom zoo: