mirror of
https://github.com/LCTT/TranslateProject.git
synced 2024-12-29 21:41:00 +08:00
a71aa7de9e
renamed: 10 Linux Platforms Meant For Embedded Systems.md -> 201406/10 Linux Platforms Meant For Embedded Systems.md renamed: 20140527 4MLinux 9.0 Beta Is a 55 MB Operating System That Has It All.md -> 201406/20140527 4MLinux 9.0 Beta Is a 55 MB Operating System That Has It All.md renamed: 20140527 A Complete Historical Timeline of Linux Evolution.md -> 201406/20140527 A Complete Historical Timeline of Linux Evolution.md renamed: 20140528 Setup Backup Server Using Bacula And Webmin On Ubuntu 14.04.md -> 201406/20140528 Setup Backup Server Using Bacula And Webmin On Ubuntu 14.04.md renamed: 20140528 Why We Shouldn't Accept Bad Linux Ports.md -> 201406/20140528 Why We Shouldn't Accept Bad Linux Ports.md renamed: 20140529 Add Windows Like Bottom Taskbar In Ubuntu Unity 14.04.md -> 201406/20140529 Add Windows Like Bottom Taskbar In Ubuntu Unity 14.04.md renamed: 20140529 Command Line Tuesdays--The Introductory.md -> 201406/20140529 Command Line Tuesdays--The Introductory.md renamed: 20140529 How To Share Disks In VirtualBox Between Linux Guest OS.md -> 201406/20140529 How To Share Disks In VirtualBox Between Linux Guest OS.md renamed: 20140529 Install RainLoop Webmail (A Web Based Email Client) using 'Nginx and Apache' in Arch Linux.md -> 201406/20140529 Install RainLoop Webmail (A Web Based Email Client) using 'Nginx and Apache' in Arch Linux.md renamed: 20140529 What is a good terminal emulator on Linux.md -> 201406/20140529 What is a good terminal emulator on Linux.md renamed: 20140529 Why No Flash Support for Linux Is Good for Open Source.md -> 201406/20140529 Why No Flash Support for Linux Is Good for Open Source.md renamed: 20140530 Fix 'Cannot Add PPA' Error In Ubuntu 14.04 and Linux Mint.md -> 201406/20140530 Fix 'Cannot Add PPA' Error In Ubuntu 14.04 and Linux Mint.md renamed: 20140530 How To Install Linux On A MacBook Pro Retina.md -> 201406/20140530 How To Install Linux On A MacBook Pro Retina.md renamed: 20140530 Linux script command--A recorder inside your Terminal.md -> 201406/20140530 Linux script command--A recorder inside your Terminal.md renamed: 20140603 App Grid Is A Superior Ubuntu Software Center Alternative.md -> 201406/20140603 App Grid Is A Superior Ubuntu Software Center Alternative.md renamed: 20140603 Linux Foundation to donate portion of membership fees to Code.org.md -> 201406/20140603 Linux Foundation to donate portion of membership fees to Code.org.md renamed: 20140603 Write your first Linux Kernel module.md -> 201406/20140603 Write your first Linux Kernel module.md renamed: 20140604 Command line secrets.md -> 201406/20140604 Command line secrets.md renamed: 20140604 Setup Virtual Hosts In Apache On Ubuntu 14.04 LTS.md -> 201406/20140604 Setup Virtual Hosts In Apache On Ubuntu 14.04 LTS.md renamed: 20140607 Cup 2014 Brazil--Watch FIFA World Cup 2014 Competition in Your Linux Desktop.md -> 201406/20140607 Cup 2014 Brazil--Watch FIFA World Cup 2014 Competition in Your Linux Desktop.md renamed: 20140607 How To Extract Images From Videos Using ffmpeg.md -> 201406/20140607 How To Extract Images From Videos Using ffmpeg.md renamed: 20140607 How To Install iCup 2014 In Linux.md -> 201406/20140607 How To Install iCup 2014 In Linux.md renamed: 20140607 Linux--Bash Delete All Files In Directory Except Few.md -> 201406/20140607 Linux--Bash Delete All Files In Directory Except Few.md renamed: 20140607 New OpenSSL breach is no Heartbleed-but needs to be taken seriously.md -> 201406/20140607 New OpenSSL breach is no Heartbleed-but needs to be taken seriously.md renamed: 20140607 Nuvola Player 2.4.0 Released -- A Online Cloud Music Player for Linux.md -> 201406/20140607 Nuvola Player 2.4.0 Released -- A Online Cloud Music Player for Linux.md renamed: 20140607 Practical Interview Questions and Answers on Linux Shell Scripting.md -> 201406/20140607 Practical Interview Questions and Answers on Linux Shell Scripting.md renamed: 20140607 Steam Hits The Big 500 For Linux Games.md -> 201406/20140607 Steam Hits The Big 500 For Linux Games.md renamed: 20140607 Ubuntu One Formally Shuts Down.md -> 201406/20140607 Ubuntu One Formally Shuts Down.md renamed: 20140609 How To Know If Your System Has USB 3.0 Port In Linux [Quick Tip].md -> 201406/20140609 How To Know If Your System Has USB 3.0 Port In Linux [Quick Tip].md renamed: 20140609 Open Source LDAP Solutions.md -> 201406/20140609 Open Source LDAP Solutions.md renamed: "20140609 OpenELEC 4.0.4 \347\216\260\345\267\262\345\217\221\345\270\203, \345\237\272\344\272\216 XBMC 13.1 \342\200\234Gotham\342\200\235.md" -> "201406/20140609 OpenELEC 4.0.4 \347\216\260\345\267\262\345\217\221\345\270\203, \345\237\272\344\272\216 XBMC 13.1 \342\200\234Gotham\342\200\235.md" renamed: 20140610 How to set up Internet connection sharing with iptables on Linux.md -> 201406/20140610 How to set up Internet connection sharing with iptables on Linux.md renamed: 20140610 IPFire 2.13 Core 78 Linux Firewall OS Receives OpenSSL Fixes.md -> 201406/20140610 IPFire 2.13 Core 78 Linux Firewall OS Receives OpenSSL Fixes.md renamed: 20140610 Open Source SDN Project OpenDaylight Adds New Members.md -> 201406/20140610 Open Source SDN Project OpenDaylight Adds New Members.md renamed: 20140610 Top 7 Desktop Environment For Linux.md -> 201406/20140610 Top 7 Desktop Environment For Linux.md renamed: 20140611 HTG Explains--What' s the Difference Between Linux and BSD.md -> 201406/20140611 HTG Explains--What' s the Difference Between Linux and BSD.md renamed: 20140611 How to Prevent Other Users From Accessing Your Home Directory in Ubuntu 14.04.md -> 201406/20140611 How to Prevent Other Users From Accessing Your Home Directory in Ubuntu 14.04.md renamed: 20140612 Command Line Tuesdays--Part One.md -> 201406/20140612 Command Line Tuesdays--Part One.md renamed: 20140612 Dpkg Vulnerabilities Closed in Ubuntu 14.04.md -> 201406/20140612 Dpkg Vulnerabilities Closed in Ubuntu 14.04.md renamed: 20140616 How To Install Numix Icon Theme In Fedora 20.md -> 201406/20140616 How To Install Numix Icon Theme In Fedora 20.md renamed: 20140616 Ubuntu Desktop Next 14.10 Images Available to Download.md -> 201406/20140616 Ubuntu Desktop Next 14.10 Images Available to Download.md renamed: 20140616 Ubuntu for Phones Activated on 10,000 Devices.md -> 201406/20140616 Ubuntu for Phones Activated on 10,000 Devices.md renamed: 20140617 14 Apps To Boost Ubuntu.md -> 201406/20140617 14 Apps To Boost Ubuntu.md renamed: 20140619 Improve Battery Life with Laptop Mode Tools 1.65.md -> 201406/20140619 Improve Battery Life with Laptop Mode Tools 1.65.md renamed: 20140619 Red Hat to Acquire eNovance, Focus Together on OpenStack.md -> 201406/20140619 Red Hat to Acquire eNovance, Focus Together on OpenStack.md renamed: 20140620 Celebrating 30 Years of X.md -> 201406/20140620 Celebrating 30 Years of X.md renamed: 20140620 ENCRYPT DNS TRAFFIC IN LINUX WITH DNSCRYPT (VIA OPENDNS).md -> 201406/20140620 ENCRYPT DNS TRAFFIC IN LINUX WITH DNSCRYPT (VIA OPENDNS).md renamed: 20140620 How to enable testing and unstable repository on Debian.md -> 201406/20140620 How to enable testing and unstable repository on Debian.md renamed: 20140625 Canonical Debuts 'Orange Box' for Ubuntu OpenStack Cloud Demos.md -> 201406/20140625 Canonical Debuts 'Orange Box' for Ubuntu OpenStack Cloud Demos.md renamed: 8 examples of findmnt command to check mounted file systems on Linux.md -> 201406/8 examples of findmnt command to check mounted file systems on Linux.md renamed: Bash Getopts--Scripts with Command Line Options.md -> 201406/Bash Getopts--Scripts with Command Line Options.md renamed: Collectl--An Advanced All-in-One Performance Monitoring Tool for Linux.md -> 201406/Collectl--An Advanced All-in-One Performance Monitoring Tool for Linux.md renamed: Fix Adobe Flash Player Issue In Chromium In Ubuntu 14.04.md -> 201406/Fix Adobe Flash Player Issue In Chromium In Ubuntu 14.04.md renamed: Guide To Install Ubuntu 14.04 In Dual Boot Mode With Windows 8 Or 8.1 UEFI.md -> 201406/Guide To Install Ubuntu 14.04 In Dual Boot Mode With Windows 8 Or 8.1 UEFI.md renamed: How To Install 'California' Calendar App in Ubuntu 14.04.md -> 201406/How To Install 'California' Calendar App in Ubuntu 14.04.md renamed: How To Remove Drive Icons From Unity Launcher In Ubuntu 14.04 [Beginner Tips].md -> 201406/How To Remove Drive Icons From Unity Launcher In Ubuntu 14.04 [Beginner Tips].md renamed: How to Install Windows 8.1 and Ubuntu 14.04 LTS on the Same Computer.md -> 201406/How to Install Windows 8.1 and Ubuntu 14.04 LTS on the Same Computer.md renamed: How to download webcomics from the command line on Linux.md -> 201406/How to download webcomics from the command line on Linux.md renamed: How to launch applications differently with Gnome-Pie on Linux desktop.md -> 201406/How to launch applications differently with Gnome-Pie on Linux desktop.md renamed: How to manage Linux containers with Docker on Ubuntu.md -> 201406/How to manage Linux containers with Docker on Ubuntu.md renamed: How to manage ip addresses and subnets with phpIPAM.md -> 201406/How to manage ip addresses and subnets with phpIPAM.md renamed: How to manage passwords from the command line on Linux.md -> 201406/How to manage passwords from the command line on Linux.md renamed: How to monitor Nginx web server from the command line in real time.md -> 201406/How to monitor Nginx web server from the command line in real time.md renamed: How to set up a web-based lightweight system monitor on Linux.md -> 201406/How to set up a web-based lightweight system monitor on Linux.md renamed: How to take a screenshot from the command line on Linux.md -> 201406/How to take a screenshot from the command line on Linux.md renamed: How to take full length screenshots of websites via terminal.md -> 201406/How to take full length screenshots of websites via terminal.md renamed: How to use LVM in Linux.md -> 201406/How to use LVM in Linux.md renamed: How to verify DDOS attack with netstat command on Linux Terminal.md -> 201406/How to verify DDOS attack with netstat command on Linux Terminal.md renamed: Install SoundCloud In Ubuntu 14.04.md -> 201406/Install SoundCloud In Ubuntu 14.04.md renamed: Linux Pros' Top Command Line Secrets.md -> 201406/Linux Pros' Top Command Line Secrets.md renamed: Linux Terminal--Dstat monitoring tools.md -> 201406/Linux Terminal--Dstat monitoring tools.md renamed: Making Linux Feel at Home.md -> 201406/Making Linux Feel at Home.md renamed: Open Source's Cult Of Personality Is Dying--Thankfully.md -> 201406/Open Source's Cult Of Personality Is Dying--Thankfully.md renamed: Pros' Secrets and Red Hat 7 and PCLinuxOS 2014.05 Reviews.md -> 201406/Pros' Secrets and Red Hat 7 and PCLinuxOS 2014.05 Reviews.md renamed: Start Practising Linux ip command and Avoid the Habit of Using ifconfig.md -> 201406/Start Practising Linux ip command and Avoid the Habit of Using ifconfig.md renamed: TechView--Linus Torvalds Inventor of Linux.md -> 201406/TechView--Linus Torvalds Inventor of Linux.md renamed: Turn Off Bluetooth By Default In Ubuntu 14.04 [Quick Tip].md -> 201406/Turn Off Bluetooth By Default In Ubuntu 14.04 [Quick Tip].md renamed: Ubuntu Linux Community Manager Jono Bacon Leaves Canonical.md -> 201406/Ubuntu Linux Community Manager Jono Bacon Leaves Canonical.md renamed: What Heartbleed Teaches Us--Be An Open Source Contributor, Not Just A User.md -> 201406/What Heartbleed Teaches Us--Be An Open Source Contributor, Not Just A User.md renamed: Why htop Command Compete Linux top Command.md -> 201406/Why htop Command Compete Linux top Command.md
58 lines
5.4 KiB
Markdown
58 lines
5.4 KiB
Markdown
新的OpenSSL分支未包含Heartbleed漏洞，但需要认真看待
|
||
================================================================================
|
||
> 摘要：当被最新的OpenSSL安全问题困扰时，你最好解决它，虽然它并不像Heartbleed那样糟糕。
|
||
|
||
这一周对于开源的Secure Socket Layer （SSL）来说真是糟糕的一周。
|
||
|
||
首先，[GnuTLS低调的宣称，存在一个不大][1]但确实存在的缺陷。然后，大范围流行的OpenSSL被发现包含一个[中间人漏洞][2]。在[Heartbleed漏洞][3]惨剧后，OpenSSL要醒醒了。
|
||
|
||
|
||
|
||
这个漏洞，根据谷歌高级软件工程师Adam Langley描述，已经[至少存在了15年时间][4]。可惜Core Infrastructure Initiative(CII)[提供了让更多的程序员来拯救OpenSSL的资金][5]，却尚未来得及发挥作用。
|
||
|
||
也就是说这个漏洞依然是和Heartbleed漏洞一样糟糕。对于一些新手，攻击者需要在系统和浏览器或其它启用了SSL的客户端之间来利用这个安全漏洞。
|
||
|
||
尽管它只是可能被利用，你依然需要尽可能快的通过升级来解决这个漏洞。就像[NTT Com Security][6]的评估服务负责人Chris Camejo在邮件采访里说的，“这很糟糕，因为已经存在了这么长的时间，看起来传播范围相当广泛。”
|
||
|
||
他补充到：“如果利用它，攻击者可以解密流量。从SSL的设计目的看，这是一个很严重的问题。SSL被广泛地用来在网站和邮件中保护很多的密码，信用卡卡号和其他的敏感信息。”
|
||
|
||
在另外一个采访中，Red Hat的产品安全高级负责人Mark Cox详细深入地介绍了[细节][7]。Cox说，OpenSSL已修正了一些安全缺陷，但是我们需要想办法告诉人们不要因为Heartbleed而陷入恐慌。
|
||
|
||
Cox解释说，Heartbleed漏洞在公布之前得到了修补，但利用此漏洞的消息在修补程序之前传开，因此在这个问题上招致了许多抱怨。最新的情况，已有七个安全问题得到了修补，但其中只有两项需要管理员和用户的关注。
|
||
|
||
Cox继续说道，第一个，是数据报传输层安全 (DTLS)的bug。到目前为止，还没有已知的攻击，但是存在针对它攻击成功的潜在性。
|
||
|
||
因此，虽然DTLS使用不广泛，如果您确实在使用它，它应尽快修补。
|
||
|
||
Cox然后说，“这个问题的实际上是中间人攻击”。实际上，真的要有个“在中间的”人，来利用易受攻击的服务器和客户端之间的漏洞。
|
||
|
||
但如果有人真的这样做到了，他们就能“绕过SSL并拿到原始数据...这是一个相当严重的问题”。
|
||
|
||
但是，如同从理论上讲任何人都可以利用Heartbleed漏洞来攻击SSL服务器。攻击并利用此漏洞需要能接触到客户端和服务器之间的通信网络。例如，成功的攻击可能需要架设一个假的公开Wi-Fi接入点，才能攻击到使用这个WIFI的Android版本的Chrome网络浏览器与未安装修补程序的Web服务器之间的SSL通讯。幸运的是，谷歌[已经发布了更新的版本的浏览器][8]，35.0.1916.141，以消除此问题。
|
||
|
||
Cox继续说，最易受攻击的系统是未安装修补程序的Android设备使用一个假的Wi-Fi接入点。Morrell补充说因为Android用户并没有被他们的手机供应商和电信公司重视，安全漏洞更新前他们可能会受漏洞影响相当长的时间。
|
||
|
||
幸运的是，如果他们用连接的服务器已经更新，他们也不会受到攻击。
|
||
|
||
OpenSSL安全社区自5月初以来已经知道这个问题。社区与Red Hat、其他主要Linux和开源社团和硬件供应商，要解决这个问题，不只是简单修补bug，而且要测试修复，以便他们可以确认漏洞已经修复，大家都已经安全了，而没有引入任何新的安全问题，并可在大多数 OpenSSL服务器和客户端的组合上工作。
|
||
|
||
现在，这个补丁已经有了，OpenSSL试着通过补丁解决安全缺陷，向公众表明对这些问题不必有任何不必要的恐慌。Cox补充说，主要的Linux供应商，如Red Hat和Ubuntu，已经有可用的修补程序。
|
||
|
||
所有的管理员都需要给服务器下载并安装补丁，而不是放任安全漏洞。
|
||
|
||
--------------------------------------------------------------------------------
|
||
|
||
via: http://www.zdnet.com/new-openssl-breech-is-no-heartbleed-but-needs-to-be-taken-seriously-7000030273/
|
||
|
||
译者：[lolipop](https://github.com/stduolc) 校对：[wxy](https://github.com/wxy)
|
||
|
||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创翻译，[Linux中国](http://linux.cn/) 荣誉推出
|
||
|
||
[1]:http://www.zdnet.com/another-serious-gnutls-bug-exposes-linux-clients-to-server-attacks-7000030205
|
||
[2]:http://www.zdnet.com/openssl-fixes-another-severe-vulnerability-7000030253/
|
||
[3]:http://www.zdnet.com/heartbleed-serious-openssl-zero-day-vulnerability-revealed-7000028166
|
||
[4]:https://www.imperialviolet.org/2014/06/05/earlyccs.html
|
||
[5]:http://www.zdnet.com/corporations-put-their-cash-where-their-open-source-security-is-7000030023/
|
||
[6]:http://www.nttcomsecurity.com/us/
|
||
[7]:http://ec.libsyn.com/p/6/a/5/6a58036510bae37c/CloudEvangelistPodcast_Ep92_MarkCox.mp3?d13a76d516d9dec20c3d276ce028ed5089ab1ce3dae902ea1d06c88537d1ce596fdc&c_id=7251647)
|
||
[8]:http://googlechromereleases.blogspot.com/2014/06/chrome-for-android-update.html |