摘要
HeartBleed漏洞是一个严重的安全漏洞。分析了OpenSSL中心跳机制的源代码,在代码层次总结了HeartBleed漏洞产生的原因。采用Python语言实现了漏洞检测脚本工具,通过发送心跳信息长度与长度字段不一致的心跳数据包,并根据响应数据包的类型和响应数据的长度,判断目标是否存在HeartBleed漏洞。针对应用OpenSSL的Web网站以及网络服务的服务器进行了检测实验。与已有检测工具的比较实验表明,实现的检测脚本工具检测范围广,检测时间快,正确率高,可以有效完成HeartBleed漏洞的检测工作。
Heart Bleed is a critical security vulnerability. The source code of Heart Beat in Open SSL is analyzed and the cause of Heart Bleed vulnerability is summarized. Then using Python, the vulnerability detection script tool is accomplished. The tool sends heartbeat packet whose data＇s length is inconsistent with the value of length field. According to the values of type field and length field in response packet, the tool determines whether the target has Heart Bleed vulnerability. The experiments which use this tool to detect Web websites and Web services applying Open SSL are achieved.Compared with other detection tools for Heart Bleed, the proposed detection tool has a wild detection range, rapid detection time and high accuracy rate. The tool can work effectively for Heart Bleed vulnerability detection.
出处
《计算机工程与应用》
CSCD
北大核心
2016年第9期88-95,101,共9页
Computer Engineering and Applications
基金
江苏省教育科学“十二五”规划重点基金资助项目(No.B-a/2013/01/013)
江苏省教育科学“十二五”规划项目(No.D/2013/01/002)
