{"id":477441,"date":"2023-08-09T09:15:09","date_gmt":"2023-08-09T09:15:09","guid":{"rendered":""},"modified":"2023-09-05T11:14:42","modified_gmt":"2023-09-05T11:14:42","slug":"heartbleed","status":"publish","type":"wiki","link":"https:\/\/oneproxy.pro\/cn\/wiki\/heartbleed\/","title":{"rendered":"\u5fc3\u8840"},"content":{"rendered":"<p>Heartbleed \u662f OpenSSL \u52a0\u5bc6\u8f6f\u4ef6\u5e93\u4e2d\u53d1\u73b0\u7684\u4e00\u4e2a\u4e25\u91cd\u6f0f\u6d1e\uff0c\u53ef\u5bfc\u81f4\u7a83\u53d6\u7528\u4e8e\u4fdd\u62a4\u4e92\u8054\u7f51\u5b89\u5168\u7684 SSL\/TLS \u52a0\u5bc6\u6240\u4fdd\u62a4\u7684\u4fe1\u606f\u3002<\/p>\n<h2>\u5386\u53f2\u56de\u987e\uff1a\u63ed\u5f00\u5fc3\u810f\u6ef4\u8840\u6f0f\u6d1e\u7684\u9762\u7eb1<\/h2>\n<p>Heartbleed \u4e8e 2014 \u5e74 4 \u6708\u9996\u6b21\u516c\u5f00\u62ab\u9732\uff0c\u7531 Codenomicon \u548c Google \u7684\u5b89\u5168\u5de5\u7a0b\u5e08\u72ec\u7acb\u53d1\u73b0\u3002\u5b83\u662f OpenSSL \u52a0\u5bc6\u5e93\u4e2d\u7684\u4e00\u4e2a\u5b89\u5168\u6f0f\u6d1e\uff0c\u8be5\u5e93\u662f\u4e92\u8054\u7f51\u4e0a\u6700\u53d7\u6b22\u8fce\u7684\u52a0\u5bc6\u4fdd\u62a4\u5e93\u4e4b\u4e00\u3002\u5b83\u4e4b\u6240\u4ee5\u5982\u6b64\u547d\u540d\uff0c\u662f\u56e0\u4e3a\u5b83\u662f\u5728 OpenSSL \u5e93\u7684\u201c\u5fc3\u8df3\u201d\u90e8\u5206\u53d1\u73b0\u7684\uff0c\u8fd9\u662f\u4e00\u4e2a\u7528\u4e8e\u5728\u672a\u5171\u4eab\u6570\u636e\u65f6\u4fdd\u6301\u8fde\u63a5\u6d3b\u52a8\u7684\u7cfb\u7edf\u3002<\/p>\n<h2>Heartbleed \u6f0f\u6d1e\u8be6\u89e3\uff1a\u6df1\u5165\u5256\u6790<\/h2>\n<p>Heartbleed \u7279\u522b\u5f71\u54cd\u4e86 OpenSSL \u7684\u201c\u5fc3\u8df3\u201d\u6269\u5c55\u3002\u8fd9\u662f OpenSSL \u5b9e\u73b0\u4f20\u8f93\u5c42\u5b89\u5168 (TLS) \u534f\u8bae\u7684\u53ef\u9009\u529f\u80fd\uff0c\u7528\u4e8e\u7ef4\u62a4\u5ba2\u6237\u7aef\u548c\u670d\u52a1\u5668\u4e4b\u95f4\u7684\u5b89\u5168\u8fde\u63a5\u3002<\/p>\n<p>\u8be5\u6f0f\u6d1e\u5b58\u5728\u4e8e\u5fc3\u8df3\u8bf7\u6c42\u7684\u5904\u7406\u65b9\u5f0f\u4e2d\u3002\u901a\u8fc7\u53d1\u9001\u6076\u610f\u5236\u4f5c\u7684\u5fc3\u8df3\u8bf7\u6c42\uff0c\u653b\u51fb\u8005\u53ef\u4ee5\u8bf1\u4f7f\u670d\u52a1\u5668\u6216\u5ba2\u6237\u7aef\u53d1\u56de\u5927\u91cf\u5b58\u50a8\u5728\u5176\u5185\u5b58\u4e2d\u7684\u6570\u636e\uff0c\u8fdc\u8fdc\u8d85\u51fa\u5fc3\u8df3\u7684\u9884\u671f\u8303\u56f4\u3002<\/p>\n<h2>\u5185\u90e8\u673a\u5236\uff1aHeartbleed \u7684\u5de5\u4f5c\u539f\u7406<\/h2>\n<p>OpenSSL \u4e2d\u7684\u5fc3\u8df3\u673a\u5236\u901a\u8fc7\u5411\u670d\u52a1\u5668\u53d1\u9001\u5e26\u6709\u6709\u6548\u8f7d\u8377\u548c\u6709\u6548\u8f7d\u8377\u957f\u5ea6\u7684\u8bf7\u6c42\uff08\u201c\u5fc3\u8df3\u201d\u8bf7\u6c42\uff09\u6765\u5de5\u4f5c\u3002\u7136\u540e\uff0c\u670d\u52a1\u5668\u91cd\u590d\u56de\u590d\u6709\u6548\u8f7d\u8377\u4ee5\u786e\u8ba4\u5b83\u4ecd\u7136\u5728\u7ebf\u5e76\u5904\u4e8e\u76d1\u542c\u72b6\u6001\u3002<\/p>\n<p>\u7136\u800c\uff0cHeartbleed \u6f0f\u6d1e\u7684\u51fa\u73b0\u662f\u56e0\u4e3a OpenSSL \u4e0d\u4f1a\u9a8c\u8bc1\u8bf7\u6c42\u4e2d\u53d1\u9001\u7684\u6709\u6548\u8d1f\u8f7d\u957f\u5ea6\u662f\u5426\u4e0e\u5b9e\u9645\u6709\u6548\u8d1f\u8f7d\u76f8\u5bf9\u5e94\u3002\u653b\u51fb\u8005\u53ef\u4ee5\u53d1\u9001\u4e00\u4e2a\u5e26\u6709\u8f83\u5c0f\u6709\u6548\u8d1f\u8f7d\u7684\u5fc3\u8df3\u8bf7\u6c42\uff0c\u4f46\u544a\u8bc9\u670d\u52a1\u5668\u5b83\u53d1\u9001\u4e86\u4e00\u4e2a\u66f4\u5927\u7684\u6709\u6548\u8d1f\u8f7d\uff0c\u4ece\u800c\u8bf1\u4f7f\u670d\u52a1\u5668\u53d1\u56de\u6700\u591a 64 \u5343\u5b57\u8282\u7684\u5185\u5b58\u3002\u8fd9\u4e2a\u5185\u5b58\u53ef\u80fd\u5305\u542b\u4ece\u7528\u6237\u540d\u548c\u5bc6\u7801\u5230\u7528\u4e8e SSL \u52a0\u5bc6\u7684\u5bc6\u94a5\u7684\u4efb\u4f55\u5185\u5bb9\u3002<\/p>\n<h2>Heartbleed \u7684\u4e3b\u8981\u7279\u70b9<\/h2>\n<ul>\n<li><strong>\u6570\u636e\u6cc4\u9732\uff1a<\/strong> Heartbleed \u53ef\u4ee5\u66b4\u9732\u670d\u52a1\u5668\u5185\u5b58\u4e2d\u7684\u5927\u91cf\u6570\u636e\uff0c\u5305\u62ec\u79c1\u94a5\u3001\u7528\u6237\u540d\u548c\u5bc6\u7801\u7b49\u654f\u611f\u4fe1\u606f\u3002<\/li>\n<li><strong>\u4e0d\u53ef\u63a2\u6d4b\u6027\uff1a<\/strong> Heartbleed \u6f0f\u6d1e\u7684\u5229\u7528\u4e0d\u4f1a\u7559\u4e0b\u4efb\u4f55\u75d5\u8ff9\uff0c\u56e0\u6b64\u5f88\u96be\u68c0\u6d4b\u5e76\u786e\u5b9a\u7cfb\u7edf\u662f\u5426\u5df2\u88ab\u5165\u4fb5\u3002<\/li>\n<li><strong>\u5e7f\u6cdb\u5f71\u54cd\uff1a<\/strong> \u9274\u4e8e OpenSSL \u7684\u5e7f\u6cdb\u4f7f\u7528\uff0cHeartbleed \u6f0f\u6d1e\u7684\u6f5c\u5728\u5f71\u54cd\u8303\u56f4\u975e\u5e38\u5927\uff0c\u5c06\u5f71\u54cd\u4e92\u8054\u7f51\u4e0a\u76f8\u5f53\u4e00\u90e8\u5206\u7f51\u7edc\u670d\u52a1\u5668\u3002<\/li>\n<\/ul>\n<h2>\u5fc3\u810f\u51fa\u8840\u653b\u51fb\u7684\u7c7b\u578b<\/h2>\n<p>Heartbleed \u6f0f\u6d1e\u53ef\u4ee5\u4ee5\u591a\u79cd\u65b9\u5f0f\u8868\u73b0\u51fa\u6765\uff0c\u4e3b\u8981\u53d6\u51b3\u4e8e\u6240\u4f7f\u7528\u7684 OpenSSL \u6784\u5efa\u7c7b\u578b\u548c\u6240\u6d89\u53ca\u5b9e\u4f53\u7684\u89d2\u8272\u3002<\/p>\n<table>\n<thead>\n<tr>\n<th>\u653b\u51fb\u7c7b\u578b<\/th>\n<th>\u63cf\u8ff0<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>\u670d\u52a1\u5668\u7aef Heartbleed<\/td>\n<td>\u653b\u51fb\u8005\u5411\u670d\u52a1\u5668\u53d1\u9001\u6076\u610f\u5fc3\u8df3\u8bf7\u6c42\uff0c\u8bf1\u9a97\u670d\u52a1\u5668\u54cd\u5e94\u6bd4\u5e94\u54cd\u5e94\u7684\u66f4\u591a\u7684\u6570\u636e\u3002<\/td>\n<\/tr>\n<tr>\n<td>\u5ba2\u6237\u7aef Heartbleed \u6f0f\u6d1e<\/td>\n<td>\u653b\u51fb\u8005\u8bf1\u9a97\u5ba2\u6237\u7aef\u8fde\u63a5\u5230\u6076\u610f\u670d\u52a1\u5668\uff0c\u5229\u7528\u5ba2\u6237\u7aef OpenSSL \u5e93\u4e2d\u7684 Heartbleed \u6f0f\u6d1e\u3002<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2>\u89e3\u51b3 Heartbleed \u95ee\u9898\uff1a\u95ee\u9898\u4e0e\u89e3\u51b3\u65b9\u6848<\/h2>\n<p>Heartbleed \u6f0f\u6d1e\u5229\u7528\u4f1a\u5e26\u6765\u4e25\u91cd\u7684\u5b89\u5168\u95ee\u9898\u3002\u5b83\u53ef\u4ee5\u6cc4\u9732\u654f\u611f\u4fe1\u606f\u3001\u6cc4\u9732\u52a0\u5bc6\u5bc6\u94a5\u7b49\u7b49\u3002\u4e0d\u8fc7\uff0c\u76ee\u524d\u5df2\u7ecf\u5b9e\u65bd\u4e86\u51e0\u79cd\u89e3\u51b3\u65b9\u6848\uff1a<\/p>\n<ul>\n<li><strong>\u4fee\u8865\uff1a<\/strong> \u5c06OpenSSL\u66f4\u65b0\u4e3a\u4e0d\u5305\u542bHeartbleed\u6f0f\u6d1e\u7684\u7248\u672c\uff08OpenSSL 1.0.1g\u53ca\u66f4\u9ad8\u7248\u672c\uff09\u662f\u6700\u76f4\u63a5\u7684\u89e3\u51b3\u65b9\u6848\u3002<\/li>\n<li><strong>\u5bc6\u94a5\u8f6e\u6362\uff1a<\/strong> \u4fee\u8865\u540e\uff0c\u5fc5\u987b\u66f4\u6539\u6240\u6709\u53ef\u80fd\u5df2\u6cc4\u9732\u7684\u5bc6\u94a5\u548c\u8bc1\u4e66\u3002<\/li>\n<li><strong>\u5bc6\u7801\u66f4\u6539\uff1a<\/strong> \u5728\u5b58\u5728\u6f0f\u6d1e\u7684\u670d\u52a1\u4fee\u8865\u5176\u670d\u52a1\u5668\u540e\uff0c\u7528\u6237\u5e94\u8be5\u66f4\u6539\u5bc6\u7801\u3002<\/li>\n<\/ul>\n<h2>\u4e0e\u7c7b\u4f3c\u6f0f\u6d1e\u7684\u6bd4\u8f83<\/h2>\n<p>\u867d\u7136 Heartbleed \u662f\u4e00\u79cd\u72ec\u7279\u7684\u6f0f\u6d1e\uff0c\u4f46\u4e5f\u6709\u5176\u4ed6\u6f0f\u6d1e\u4e5f\u5f71\u54cd\u4e86\u4e92\u8054\u7f51\u7684\u5b89\u5168\uff0c\u4f8b\u5982 Shellshock \u548c POODLE\u3002\u8fd9\u4e9b\u6f0f\u6d1e\u5728\u53d7\u5f71\u54cd\u7684\u8f6f\u4ef6\u3001\u5f71\u54cd\u548c\u53ef\u5229\u7528\u6027\u65b9\u9762\u5404\u4e0d\u76f8\u540c\u3002<\/p>\n<h2>\u672a\u6765\u524d\u666f\u548c\u6280\u672f<\/h2>\n<p>Heartbleed \u5f71\u54cd\u4e86\u66f4\u597d\u7684\u5b89\u5168\u534f\u8bae\u548c\u5b9e\u8df5\u7684\u5f00\u53d1\uff0c\u4ece\u800c\u6539\u8fdb\u4e86\u67e5\u627e\u548c\u4fee\u8865\u6b64\u7c7b\u6f0f\u6d1e\u7684\u673a\u5236\u3002\u8be5\u4e8b\u4ef6\u51f8\u663e\u4e86\u5b9a\u671f\u5b89\u5168\u5ba1\u6838\u3001\u81ea\u52a8\u6d4b\u8bd5\u7684\u91cd\u8981\u6027\u4ee5\u53ca\u53ca\u65f6\u4fee\u8865\u548c\u66f4\u65b0\u7684\u5fc5\u8981\u6027\u3002<\/p>\n<h2>\u4ee3\u7406\u670d\u52a1\u5668\u548c Heartbleed<\/h2>\n<p>\u4ee3\u7406\u670d\u52a1\u5668\u5145\u5f53\u5ba2\u6237\u7aef\u5411\u5176\u4ed6\u670d\u52a1\u5668\u5bfb\u6c42\u8d44\u6e90\u7684\u8bf7\u6c42\u7684\u4e2d\u4ecb\u3002\u5982\u679c\u4ee3\u7406\u670d\u52a1\u5668\u4f7f\u7528 OpenSSL\uff0c\u5219\u53ef\u80fd\u5bb9\u6613\u53d7\u5230 Heartbleed \u653b\u51fb\uff0c\u4ece\u800c\u53ef\u80fd\u6cc4\u9732\u654f\u611f\u7684\u5ba2\u6237\u7aef\u548c\u670d\u52a1\u5668\u4fe1\u606f\u3002<\/p>\n<p>\u4f46\u662f\uff0c\u4f7f\u7528\u66f4\u65b0\u7684\u5b89\u5168\u4ee3\u7406\u670d\u52a1\u5668\u4e5f\u53ef\u4ee5\u6210\u4e3a\u9632\u6b62 Heartbleed \u653b\u51fb\u7684\u4fdd\u62a4\u7b56\u7565\u7684\u4e00\u90e8\u5206\u3002\u901a\u8fc7\u786e\u4fdd\u6240\u6709\u6d41\u91cf\u90fd\u901a\u8fc7\u5b89\u5168\u4ee3\u7406\uff0c\u516c\u53f8\u53ef\u4ee5\u4e3a\u5176\u5185\u90e8\u7f51\u7edc\u589e\u52a0\u989d\u5916\u7684\u4fdd\u62a4\u5c42\u3002<\/p>\n<h2>\u76f8\u5173\u94fe\u63a5<\/h2>\n<p>\u6709\u5173 Heartbleed \u7684\u66f4\u591a\u8be6\u7ec6\u4fe1\u606f\uff0c\u60a8\u53ef\u4ee5\u67e5\u770b\u4ee5\u4e0b\u8d44\u6e90\uff1a<\/p>\n<ul>\n<li><a href=\"http:\/\/heartbleed.com\/\" target=\"_new\" rel=\"noopener nofollow\">Heartbleed \u5b98\u65b9\u7f51\u7ad9<\/a><\/li>\n<li><a href=\"https:\/\/www.openssl.org\/\" target=\"_new\" rel=\"noopener nofollow\">OpenSSL \u9879\u76ee<\/a><\/li>\n<li><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2014-0160\" target=\"_new\" rel=\"noopener nofollow\">\u56fd\u5bb6\u6f0f\u6d1e\u6570\u636e\u5e93<\/a><\/li>\n<li><a href=\"https:\/\/xkcd.com\/1354\/\" target=\"_new\" rel=\"noopener nofollow\">xkcd \u5bf9 Heartbleed \u7684\u89e3\u91ca<\/a><\/li>\n<li><a href=\"https:\/\/tools.ietf.org\/html\/rfc6520\" target=\"_new\" rel=\"noopener nofollow\">RFC 6520\uff1a\u4f20\u8f93\u5c42\u5b89\u5168\u6027 (TLS) \u548c\u6570\u636e\u62a5\u4f20\u8f93\u5c42\u5b89\u5168\u6027 (DTLS) \u5fc3\u8df3\u6269\u5c55<\/a><\/li>\n<\/ul>","protected":false},"featured_media":468533,"menu_order":0,"template":"","meta":{"_acf_changed":false,"content-type":"","inline_featured_image":false,"footnotes":""},"class_list":["post-477441","wiki","type-wiki","status-publish","has-post-thumbnail","hentry"],"acf":{"faq_title":"Frequently Asked Questions about <mark>Heartbleed: A Comprehensive Guide<\/mark>","faq_items":[{"question":"What is Heartbleed?","answer":"<p>Heartbleed is a significant vulnerability in the OpenSSL cryptographic software library that allows an attacker to steal information that's normally protected by SSL\/TLS encryption, which is used to secure the Internet.<\/p>"},{"question":"When was Heartbleed first discovered?","answer":"<p>Heartbleed was first publicly disclosed in April 2014, discovered independently by security engineers at Codenomicon and Google.<\/p>"},{"question":"How does the Heartbleed bug work?","answer":"<p>Heartbleed exploits a flaw in the \"heartbeat\" feature of OpenSSL. An attacker sends a malformed heartbeat request to a server, indicating a large payload size but only sending a small one. Since OpenSSL doesn't verify that the payload size matches the actual payload, the server ends up sending back up to 64 kilobytes of its memory.<\/p>"},{"question":"What types of attacks can occur due to Heartbleed?","answer":"<p>Heartbleed vulnerability can manifest in server-side and client-side attacks. In a server-side attack, an attacker sends malicious heartbeat requests to the server, while in a client-side attack, an attacker tricks a client into connecting to a malicious server, exploiting the Heartbleed vulnerability in the client's OpenSSL library.<\/p>"},{"question":"What steps can be taken to address the Heartbleed vulnerability?","answer":"<p>The primary steps to address the Heartbleed vulnerability involve patching the OpenSSL software to a version that doesn't contain the Heartbleed vulnerability, rotating all keys and certificates that could have been revealed, and changing user passwords after a vulnerable service has patched their servers.<\/p>"},{"question":"How does Heartbleed relate to proxy servers?","answer":"<p>If a proxy server uses OpenSSL, it could be vulnerable to Heartbleed, which can potentially leak sensitive client and server information. However, by directing all traffic through a secure, updated proxy server, it can add an additional layer of protection against Heartbleed.<\/p>"},{"question":"What impact has Heartbleed had on future technologies and security protocols?","answer":"<p>Heartbleed has prompted the development of improved security protocols and practices. It has highlighted the need for regular security audits, automated testing, and timely patching and updates.<\/p>"},{"question":"Where can I find more detailed information about Heartbleed?","answer":"<p>More detailed information on Heartbleed can be found on the official Heartbleed website, OpenSSL Project site, the National Vulnerability Database, and through other resources such as an explanation comic by xkcd and the official RFC document on the TLS and DTLS Heartbeat Extension.<\/p>"}]},"_links":{"self":[{"href":"https:\/\/oneproxy.pro\/cn\/wp-json\/wp\/v2\/wiki\/477441","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/oneproxy.pro\/cn\/wp-json\/wp\/v2\/wiki"}],"about":[{"href":"https:\/\/oneproxy.pro\/cn\/wp-json\/wp\/v2\/types\/wiki"}],"version-history":[{"count":0,"href":"https:\/\/oneproxy.pro\/cn\/wp-json\/wp\/v2\/wiki\/477441\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/oneproxy.pro\/cn\/wp-json\/wp\/v2\/media\/468533"}],"wp:attachment":[{"href":"https:\/\/oneproxy.pro\/cn\/wp-json\/wp\/v2\/media?parent=477441"}],"curies":[{"name":"\u53ef\u6e7f\u6027\u7c89\u5242","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}