[B! openssl] at_yasuã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

at_yasu id:at_yasu

opensslã«é–¢ã™ã‚‹at_yasuã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (26)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

OpenSSLã«2ä»¶ã®æ·±åˆ»ãªè„†å¼±æ€§--æ—©æ€¥ã«ãƒ‘ãƒƒãƒã®é©ç”¨ã‚’
Steven J. Vaughan-NicholsÂ ï¼ˆSpecial to ZDNET.comï¼‰Â ç¿»è¨³æ ¡æ£ï¼šÂ ç·¨é›†éƒ¨ 2016-05-06 11:28 ã€ŒOpenSSLã€ã«2ä»¶ã®è„†å¼±æ€§ãŒå˜åœ¨ã—ã€ãƒ‘ãƒƒãƒãŒæä¾›ã•ã‚ŒãŸã“ã¨ãŒæ˜Žã‚‰ã‹ã«ãªã£ãŸã€‚ã©ã¡ã‚‰ã®è„†å¼±æ€§ã‚‚ã€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã«é‡å¤§ãªå½±éŸ¿ã‚’åŠã¼ã™å¯èƒ½æ€§ãŒã‚ã‚‹ã€‚ æš—å·ãƒ©ã‚¤ãƒ–ãƒ©ãƒªã§ã‚ã‚‹OpenSSLã¯ã€æœ‰åãªã‚¦ã‚§ãƒ–ã‚µã‚¤ãƒˆã®SSLã‚„TLSã§ã‚‚åˆ©ç”¨ã•ã‚Œã¦ãŠã‚Šã€ã“ã‚Œã«ã¯Twitterã€GitHubã€Tumblrã€Steamã€DropBoxãªã©ã‚‚å«ã¾ã‚Œã‚‹ã€‚ OpenSSLãŒä½¿ã‚ã‚Œã¦ã„ã‚‹ã®ã¯ã‚¦ã‚§ãƒ–ã‚µã‚¤ãƒˆã ã‘ã§ã¯ãªã„ã€‚ã‚ªãƒ¼ãƒ—ãƒ³ã‚½ãƒ¼ã‚¹ã®ä»®æƒ³ãƒ—ãƒ©ã‚¤ãƒ™ãƒ¼ãƒˆãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ã§ã‚ã‚‹ã€ŒOpenVPNã€ã‚„ã€ãƒªãƒ¢ãƒ¼ãƒˆã‹ã‚‰ã‚¿ãƒ¼ãƒŸãƒŠãƒ«ã«å®‰å…¨ã«ãƒã‚°ã‚¤ãƒ³ã™ã‚‹ãŸã‚ã«ä½¿ç”¨ã™ã‚‹ã€ŒOpenSSHã€ã®å¤ã„ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã§ã‚‚ä½¿ç”¨ã•ã‚Œã¦ã„ã‚‹ã€‚ ã“ã‚Œã¯ã€ã‚»ã‚ãƒ¥ã‚¢ãªã‚µãƒ¼ãƒã‚’é‹ç”¨ã—ã¦ã„ã‚Œã°ã€OpenSSLã‚’åˆ©ç”¨ã—ã¦ã„ã‚‹
at_yasu 2016/05/06
ã‚¢ãƒƒãƒ—ãƒ‡ãƒ¼ãƒˆç¥ã‚Šç™ºç”Ÿã®ãŠçŸ¥ã‚‰ã›â€¦ï¼Ÿ

openssl
ãƒªãƒ³ã‚¯
OpenSSLã®è„†å¼±æ€§CVE-2016-800(DROWN)ã‚„CVE-2016-0702(CacheBleed)ã«ã¤ã„ã¦ã¾ã¨ã‚ã¦ã¿ãŸ - piyolog
2016å¹´3æœˆ1æ—¥(ç¾åœ°æ™‚é–“)ã€OpenSSL ãƒ—ãƒã‚¸ã‚§ã‚¯ãƒˆã¯è„†å¼±æ€§ã®æ„›ç§°ã€ŒDROWNã€ã‚„ã€ŒCacheBleedã€ã‚’å«ã‚€8ä»¶ã®è„†å¼±æ€§æƒ…å ±ã‚’å…¬é–‹ã—ã€ã“ã‚Œã‚‰å½±éŸ¿ã‚’å—ã‘ã‚‹ã‚‚ã®ã®ä¿®æ£ã‚’è¡Œã£ãŸæœ€æ–°ç‰ˆã‚’ãƒªãƒªãƒ¼ã‚¹ã—ã¾ã—ãŸã€‚ã“ã“ã§ã¯é–¢é€£æƒ…å ±ã‚’ã¾ã¨ã‚ã¾ã™ã€‚ è„†å¼±æ€§æƒ…å ±æ¦‚è¦ æ³¨æ„å–šèµ· OpenSSL ã®è¤‡æ•°ã®è„†å¼±æ€§ã«é–¢ã™ã‚‹æ³¨æ„å–šèµ· - JPCERT/CC SSLv2 DROWN Attack - US-CERT OpenSSL Projectã®å…¬é–‹æƒ…å ± Forthcoming OpenSSL releases OpenSSL Security Advisory ï¼»1st March 2016ï¼½ OpenSSL version 1.0.1s published OpenSSL version 1.0.2g published An OpenSSL Userâ€™s Guide to DROWN 2016å¹´3æœˆ1æ—¥å…¬
at_yasu 2016/03/02
security

openssl
ãƒªãƒ³ã‚¯
ã‚·ã‚§ãƒ«ã‚¹ã‚¯ãƒªãƒ—ãƒˆã®å¹³æ–‡ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã‚’ã‚»ã‚ãƒ¥ã‚¢ã«ã™ã‚‹æ–¹æ³• - ä½™ç™½ã®æ›¸ããªãã‚Š
è¿½è¨˜: (2015/8/3) å¤§é‡ã®ã¯ã¦ãƒ–ãŒä»˜ã„ãŸã®ã§ ç¶šã ã‚’æ›¸ãã¾ã—ãŸã€‚ sshã‚’ä½¿ç”¨ã—ã¦ã„ã‚‹äººã¯æ–‡å—åˆ—ã‚’æ‰‹è»½ã«æš—å·åŒ–ãƒ»å¾©å·åŒ–ã§ãã‚‹ã¨ã„ã†è©±ã€‚ ã“ã®ãƒ†ã‚¯ãƒ‹ãƒƒã‚¯ã‚’ä½¿ãˆã°è‰²ã€…ã‚»ã‚ãƒ¥ã‚¢ã«ãªã‚‹ã®ã§ãŠã™ã™ã‚ã€‚ ä»Šå›žã¯ã‚·ã‚§ãƒ«ã‚¹ã‚¯ãƒªãƒ—ãƒˆä¸ã®å¹³æ–‡ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã‚’ã‚»ã‚ãƒ¥ã‚¢ã«ä»£æ›¿ã™ã‚‹ã€‚ å¹³æ–‡ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã¯ã‚„ã‚ã‚ˆã† ã‚·ã‚§ãƒ«ã‚¹ã‚¯ãƒªãƒ—ãƒˆä¸ã§ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ãŒå¿…è¦ã«ãªã£ãŸã¨ãã€ ã¨ã‚Šã‚ãˆãšå¹³æ–‡ã§æ›¸ã„ã¦ã—ã¾ã„ãŒã¡ã€‚ #!/bin/sh PASSWORD="hoge" ã“ã‚Œã‚’ã‚»ã‚ãƒ¥ã‚¢ã«ã—ãŸã„ã€‚ é¢å€’ãã•ã„ã®ã¯å«Œãªã®ã§ã€ãªã‚‹ã¹ãæ‰‹æŒã¡ã®ãƒ„ãƒ¼ãƒ«ã§æš—å·åŒ–ã€å¾©å·åŒ–ã—ãŸã„ã€‚ sshç”¨ã® rsa ç§˜å¯†éµã¨ã€openssl(å¤§æŠµã®ç’°å¢ƒã«å…¥ã£ã¦ã„ã‚‹)ã‚’ä½¿ã£ã¦æ”¹å–„ã—ã‚ˆã†ã€‚ ç§˜å¯†éµã®æº–å‚™ ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã‚’æš—å·åŒ–ã™ã‚‹ã«ã‚ãŸã£ã¦ã€ç§˜å¯†éµã‚’ä½¿ç”¨ã™ã‚‹ï¼Ž sshã‚’å¸¸ç”¨ã—ã¦ã„ã‚‹å ´åˆã¯ ~/.ssh/id_rsa ã¨ã„ã†ç§˜å¯†éµãŒå˜åœ¨ã™ã‚‹ã ã‚ã†ã€‚ ã‚‚ã—ç§˜å¯†éµãŒç„¡ã‘ã‚Œã°
at_yasu 2015/08/02
opensslã‚³ãƒžãƒ³ãƒ‰ã§å¹³æ–‡ã‚’æš—å·å¾©å·ã™ã‚‹è©±ã€‚å‰ææ¡ä»¶ã¯æ°—ã«ã—ãªã„ã€‚

openssl
ãƒªãƒ³ã‚¯
OpenSSLã®æ›´æ–°ç‰ˆå…¬é–‹ã€ã€ŒLogjamã€å¯¾ç–ã‚’å®Ÿè£…
ã€ŒLogjamã€ã¨å‘¼ã°ã‚Œã‚‹TLSãƒ—ãƒãƒˆã‚³ãƒ«ã®è„†å¼±æ€§ã®æ‚ªç”¨ã‚’é˜²ãå¯¾ç–ã‚’å®Ÿè£…ã—ãŸã»ã‹ã€6ä»¶ã®è„†å¼±æ€§ãŒä¿®æ£ã•ã‚ŒãŸã€‚ OpenSSLã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚¢ãƒƒãƒ—ãƒ‡ãƒ¼ãƒˆãŒ6æœˆ11æ—¥ä»˜ã§å…¬é–‹ã•ã‚ŒãŸã€‚ã€ŒLogjamã€ã¨å‘¼ã°ã‚Œã‚‹TLSãƒ—ãƒãƒˆã‚³ãƒ«ã®è„†å¼±æ€§ã®æ‚ªç”¨ã‚’é˜²ãå¯¾ç–ãªã©ãŒç››ã‚Šè¾¼ã¾ã‚Œã¦ã„ã‚‹ã€‚ Logjamã¯éŽåŽ»ã®ç±³æ”¿åºœã®æš—å·è¼¸å‡ºè¦åˆ¶ã«èµ·å› ã™ã‚‹è„†å¼±æ€§ã§ã€æ”»æ’ƒè€…ãŒä¸é–“è€…æ”»æ’ƒã‚’ä»•æŽ›ã‘ã¦TLSæŽ¥ç¶šã®æš—å·åŒ–æ–¹å¼ã‚’æ ¼ä¸‹ã’ã•ã›ã€é€šä¿¡ã®å†…å®¹ã‚’å‚å—ã—ãŸã‚Šã€æ”¹ã–ã‚“ã—ãŸã‚Šã§ãã‚‹å¯èƒ½æ€§ãŒæŒ‡æ‘˜ã•ã‚Œã¦ã„ã‚‹ã€‚OpenSSLã®æ›´æ–°ç‰ˆï¼ˆ1.0.2bãŠã‚ˆã³1.0.1nï¼‰ã§ã¯ã“ã®è„†å¼±æ€§ã‚’çªãæ”»æ’ƒã‚’é˜²ããŸã‚ã®ä»•çµ„ã¿ã‚’è¿½åŠ ã—ãŸã€‚ ä»–ã«ã‚‚6ä»¶ã®è„†å¼±æ€§ãŒä¿®æ£ã•ã‚Œã¦ãŠã‚Šã€å±é™ºåº¦ã¯ã„ãšã‚Œã‚‚ä¸ï½žä½Žãƒ¬ãƒ™ãƒ«ã¨è©•ä¾¡ã•ã‚Œã¦ã„ã‚‹ã€‚è„†å¼±æ€§ãŒå˜åœ¨ã™ã‚‹ã®ã¯OpenSSL 1.0.2ã€1.0.1ã€1.0.0ã€0.9.8ã®å„ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã€‚ãã‚Œãžã‚Œ1.0.2bã€1.0.1nã€1.0.0s
at_yasu 2015/06/12
openssl

security
ãƒªãƒ³ã‚¯
OpenSSLã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚¢ãƒƒãƒ—ãƒ‡ãƒ¼ãƒˆãŒå…¬é–‹ã¸
å°åˆ·ã™ã‚‹ ãƒ¡ãƒ¼ãƒ«ã§é€ã‚‹ ãƒ†ã‚ã‚¹ãƒˆ HTML é›»åæ›¸ç± PDF ãƒ€ã‚¦ãƒ³ãƒãƒ¼ãƒ‰ ãƒ†ã‚ã‚¹ãƒˆ é›»åæ›¸ç± PDF ã‚¯ãƒªãƒƒãƒ—ã—ãŸè¨˜äº‹ã‚’Myãƒšãƒ¼ã‚¸ã‹ã‚‰èªã‚€ã“ã¨ãŒã§ãã¾ã™ OpenSSLã®ã‚¢ãƒƒãƒ—ãƒ‡ãƒ¼ãƒˆãŒ3æœˆ19æ—¥ã«ãƒªãƒªãƒ¼ã‚¹ã•ã‚Œã‚‹ã€‚ã“ã®ã‚¢ãƒƒãƒ—ãƒ‡ãƒ¼ãƒˆã§ã¯ã€æ·±åˆ»åº¦ãŒã€Œé«˜ã€ã¨ãƒ¬ãƒ¼ãƒ†ã‚£ãƒ³ã‚°ã•ã‚Œã¦ã„ã‚‹ã‚‚ã®ã‚’1ä»¶å«ã‚€ã€å¤šãã®æœªå…¬è¡¨ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ›ãƒ¼ãƒ«ãŒä¿®æ£ã•ã‚Œã‚‹ã€‚ OpenSSLãƒ—ãƒã‚¸ã‚§ã‚¯ãƒˆã¯é–‹ç™ºè€…ã«å‘ã‘ãŸé€šçŸ¥ã§ã€ãƒãƒ¼ã‚¸ãƒ§ãƒ³1.0.2aã€1.0.1mã€1.0.0rã€0.9.8zfã‚’19æ—¥ã«ãƒªãƒªãƒ¼ã‚¹ã™ã‚‹ã¨ç™ºè¡¨ã—ãŸã€‚è„†å¼±æ€§ã®è©³ç´°ã¯ã€æ”»æ’ƒãŒåºƒãŒã‚‹ã®ã‚’æŠ‘åˆ¶ã™ã‚‹ãŸã‚ã«ä»Šã®ã¨ã“ã‚é–‹ç¤ºã•ã‚Œã¦ã„ãªã„ã€‚ OpenSSLã«ã¯æœ€è¿‘ã€è„†å¼±æ€§ã‚’ä¿®æ£ã™ã‚‹ãŸã‚ã®ãƒ‘ãƒƒãƒãŒå¤šããƒªãƒªãƒ¼ã‚¹ã•ã‚Œã¦ã„ã‚‹ã€‚ OpenSSLã¯ç‰¹ã«æ™®åŠã—ã¦ãŠã‚Šã€åºƒãåˆ©ç”¨ã§ãã‚‹ã‚ªãƒ¼ãƒ—ãƒ³ã‚½ãƒ¼ã‚¹ãƒ„ãƒ¼ãƒ«ã‚ãƒƒãƒˆã®1ã¤ã§ã€SSLã¨TLSã‚’å®Ÿè£…ã—ã¦ã„ã‚‹ã€‚ã—ã‹ã—ã€æœ€è¿‘è©±é¡Œã«ãªã£ãŸä¸€é€£ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
at_yasu 2015/03/18
openssl

security
ãƒªãƒ³ã‚¯
ã€ŒOpenSSLã€ã«æ–°ãŸãªè¤‡æ•°ã®è„†å¼±æ€§ã€æ·±åˆ»åº¦ã¯ã€Œä¸ã€ãƒ¬ãƒ™ãƒ«ï¼ˆJVNï¼‰ | ScanNetSecurity
at_yasu 2015/01/14
security

openssl
ãƒªãƒ³ã‚¯
r/crypto - OpenSSL bug allows RSA 1024 key factorization in 20 minutes
Thankfully it's very easy to tell whether it's real. If anyone can publish the two, non-trivial factors of this number (where neither is 1!) then they'll have my attention: 0xe5c30e1286c41c7137dc06194199dde641120de591c1b7392de35ef6a961d6d29faa3bcdb7603d42768a90322197a7a46fa2cf23f6f10de5554db6e7322ba35e858f576f840347c795c8782c3f4ef9f530d2fd1f6b5c275ce49404958f0decddd0b53386d12c745891d5eeca1f265bdf8
at_yasu 2014/10/06
1024bitã ã¨ä¸¸ã‚èª¤å·®ã§20åˆ†ã§å› æ•°åˆ†è§£ã§ããŸã£ã½ã„è©± / æœ¬å½“ã‹ã©ã†ã‹ã¯ ã¡ã‚‡ã£ã¨ã‚ã‹ã‚‰ã‚“

security

openssl
ãƒªãƒ³ã‚¯
Wiresharkã§SSLé€šä¿¡ã®ä¸èº«ã‚’è¦—ã„ã¦ã¿ã‚‹ - ã‚ã°é›»åãŒè©°ã¾ã¤ã¦ã‚ã‚‹
OpenSSLã®è„†å¼±æ€§ã€ŒHeartbleedã€ãŒä¸–é–“ã‚’è³‘ã‚ã›ã¦ã„ã¾ã™ãŒã€è‰²ã€…ã¨ä¹—ã‚Šé…ã‚Œã¦ã—ã¾ã£ãŸæ„ŸãŒã‚ã‚‹ã®ã§ã€ã‚†ã‚‹ã‚†ã‚‹ã¨è½ã¡ç©‚æ‹¾ã„ã‚’ã—ã‚ˆã†ã‹ã¨æ€ã„ã¾ã™ã€‚ Heartbleedã§ç§˜å¯†éµã‚’æ‰‹ã«å…¥ã‚ŒãŸã‚‰SSLé€šä¿¡ã®ä¸èº«å…¨éƒ¨è¦‹ãˆã¡ã‚ƒã†ã˜ã‚ƒã‚“!! ã¨ã„ã†äº‹æ…‹ã«ãªã£ã¦ã„ã¾ã™ãŒã€ãªã‚“ã¨ãªãç†è«–çš„ã«ãã†ã ã‚ã†ãªã¨åˆ†ã‹ã‚‹ã‚‚ã®ã®ã‚¤ãƒžã‚¤ãƒå…·ä½“çš„ãªæ‰‹é †ãŒåˆ†ã‹ã‚‰ãªã„ã€‚ ã¨ã„ã†ã‚ã‘ã§ä»Šå›žã®ãƒ†ãƒ¼ãƒžã¨ã—ã¦ã€æ‰‹å…ƒã«ã‚µãƒ¼ãƒã®ç§˜å¯†éµã¨ã€SSLé€šä¿¡ã‚’ãƒ‘ã‚±ãƒƒãƒˆã‚ãƒ£ãƒ—ãƒãƒ£ã—ãŸpcapãƒ•ã‚¡ã‚¤ãƒ«ãŒã‚ã‚‹ã¨ãã«ã€Wiresharkã§ã©ã‚“ãªæ„Ÿã˜ã§SSLé€šä¿¡ã‚’ã€Œã»ã©ãã€ã®ã‹â€¦â€¦ã¨ã„ã†å…·ä½“çš„ãªæ‰‹é †ã‚’ã€ãƒãƒžã‚Šæ‰€ã‚’å«ã‚ã¦ã¾ã¨ã‚ã¦ãŠã“ã†ã‹ã¨æ€ã„ã¾ã™ã€‚ ã¨ã„ã†ã‹ã€ç§è‡ªèº«ãŒãƒãƒžã£ãŸã®ã§è‡ªåˆ†ç”¨ãƒ¡ãƒ¢ã§ã™ãªã€‚ãªãŠã“ã®æ–‡æ›¸ã§ã¯"SSL"ã¨ã ã‘è¨˜è¿°ã—ã€TLSã¯ç„¡è¦–ã—ã¦ã„ã¾ã™ã€‚ å‰ææ¡ä»¶ ã¨ã‚Šã‚ãˆãšä»¥ä¸‹ã®ã‚ˆã†ãªæ„Ÿã˜ã®æ¤œè¨¼ç’°å¢ƒã§è©¦ã—ã¾ã—ãŸã€‚ IPã‚¢ãƒ‰ãƒ¬ã‚¹ èª¬æ˜Ž ãƒ›ã‚¹ãƒˆO
at_yasu 2014/08/19
security

openssl
ãƒªãƒ³ã‚¯
OpenBSDã€OpenSSLã‹ã‚‰ãƒ•ã‚©ãƒ¼ã‚¯ã—ãŸã€ŒLibreSSL 2.0ã€ã®Portableç‰ˆã‚’ãƒªãƒªãƒ¼ã‚¹ | OSDN Magazine
OpenBSD Foundationã®LibreSSLé–‹ç™ºãƒãƒ¼ãƒ ã¯7æœˆ11æ—¥ã€OpenSSLã‹ã‚‰ãƒ•ã‚©ãƒ¼ã‚¯ã—ãŸSSLå®Ÿè£…ã€ŒLibreSSL 2.0.0ã€ã®Porta bleç‰ˆï¼ˆãƒžãƒ«ãƒãƒ—ãƒ©ãƒƒãƒˆãƒ•ã‚©ãƒ¼ãƒ å¯¾å¿œç‰ˆï¼‰ã‚’ãƒªãƒªãƒ¼ã‚¹ã—ãŸã€‚æ—©æœŸãƒªãƒªãƒ¼ã‚¹ã¨ã„ã†ä½ç½®ä»˜ã‘ã§ã€ä»Šå¾Œã¯ãƒ•ã‚£ãƒ¼ãƒ‰ãƒãƒƒã‚¯ã‚’æ±‚ã‚ã¦æ”¹å–„ã«ã¤ãªã’ã‚‹æ„å‘ã ã€‚ LibreSSLã¯4æœˆã«æ˜Žã‚‰ã‹ã«ãªã£ãŸOpenSSLã®è„†å¼±æ€§ï¼ˆé€šç§°Hertbleedï¼‰ã«é–¢é€£ã™ã‚‹è«¸å•é¡Œã‚’ç™ºç«¯ã¨ã—ã¦ã€OpenBSDãƒ—ãƒã‚¸ã‚§ã‚¯ãƒˆãŒ4æœˆæœ«ã«é–‹å§‹ã—ãŸãƒ—ãƒã‚¸ã‚§ã‚¯ãƒˆã€‚OpenSSLã®ã‚³ãƒ¼ãƒ‰ã®ãƒªãƒ•ã‚¡ã‚¯ã‚¿ãƒªãƒ³ã‚°ã‚„ã‚¯ãƒªãƒ¼ãƒ³ãƒŠãƒƒãƒ—ã‚’è¡Œã„ã€å®‰å…¨æ€§ã‚„å®‰å®šæ€§ã®é«˜ã„SSL/TLSãƒ—ãƒãƒˆã‚³ãƒ«ã®ãƒ•ãƒªãƒ¼å®Ÿè£…ã‚’é–‹ç™ºã™ã‚‹ã“ã¨ã‚’ç›®çš„ã¨ã™ã‚‹ã€‚ãƒ—ãƒã‚¸ã‚§ã‚¯ãƒˆç™ºè¡¨æ™‚ã«ã¯ã€Œ1é€±é–“ã§åŠåˆ†ä»¥ä¸Šã®OpenSSLã‚½ãƒ¼ã‚¹ãƒ„ãƒªãƒ¼ã‚’å‰Šé™¤ã—ãŸã€ã“ã¨ã‚‚å…¬ã«ã•ã‚Œã¦ã„ãŸã€‚ ãã®å¾Œã€æ¨™æº–ãƒ©ã‚¤ãƒ–ãƒ©ãƒªã‚’ä½¿ã£ãŸãƒ¡ãƒ¢ãƒªç®¡ç†ã‚„FIPSï¼ˆFederal Inf
at_yasu 2014/07/15
ã•ã™ãŒã€é€Ÿã„â€¦

OpenBSD

libreSSL

openssl
ãƒªãƒ³ã‚¯
ç±³ITå¤§æ‰‹ã€æš—å·åŒ–ã‚½ãƒ•ãƒˆã®å®‰å…¨å¯¾ç–ã§å›£ä½“è¨ç«‹ - æ—¥æœ¬çµŒæ¸ˆæ–°èž
ã€ã‚·ãƒªã‚³ãƒ³ãƒãƒ¬ãƒ¼=å…¼æ¾é›„ä¸€éƒŽã€‘ç±³ãƒžã‚¤ã‚¯ãƒã‚½ãƒ•ãƒˆãªã©ITï¼ˆæƒ…å ±æŠ€è¡“ï¼‰å¤§æ‰‹ãŒæ±ºæ¸ˆãªã©ã«ä½¿ã‚ã‚Œã‚‹ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆã®æš—å·åŒ–ã‚½ãƒ•ãƒˆã®å®‰å…¨æ€§å¼·åŒ–ã«å…±åŒã§ä¹—ã‚Šå‡ºã—ãŸã€‚æ·±åˆ»ãªæ¬ é™¥ãŒç›¸æ¬¡ãŽè¦‹ã¤ã‹ã£ãŸãŸã‚ã€å…±åŒã§è³‡é‡‘ã‚’æ‹ å‡ºã—ã¦å›£ä½“ã‚’è¨ç«‹ã€æ¬ é™¥ã®ç™ºè¦‹ã‚„ä¿®å¾©ã«æºã‚ã‚‹æŠ€è¡“è€…ã‚’å¸¸é§ã•ã›ã‚‹ã€‚åˆ©ç”¨è€…ã®å€‹äººæƒ…å ±æ¼æ´©ãªã©ã®è¢«å®³æ‹¡å¤§ã‚’æŠ‘ãˆã€ãƒãƒƒãƒˆã®ä¿¡é ¼æ€§ä½Žä¸‹ã‚’é˜²ãã€‚4æœˆã«ãƒãƒƒãƒˆã®é€šä¿¡ã‚’æš—å·åŒ–ã™ã‚‹ã‚½ãƒ•ãƒˆã€Œã‚ªãƒ¼ãƒ—ãƒ³SSLã€ã«ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ¼
at_yasu 2014/06/20
security

openssl
ãƒªãƒ³ã‚¯
OpenSSL ã® Man-in-the-middle æ”»æ’ƒå¯èƒ½ãªè„†å¼±æ€§ã®å½±éŸ¿ â€“ IIJ Security Diary
OpenSSL ã« Man-in-the-middle (MITM) æ”»æ’ƒãŒå¯èƒ½ãªè„†å¼±æ€§ CVE-2014-0224 ãŒç™ºè¦‹ã•ã‚Œã€æ—¥æœ¬æ™‚é–“2014å¹´6æœˆ5æ—¥ã®å¤œã«å…¬é–‹ã•ã‚Œã¾ã—ãŸã€‚ãã®ã‚¢ãƒ‰ãƒã‚¤ã‚¶ãƒªã§ã¯åˆã‚ã›ã¦7ä»¶ã®è„†å¼±æ€§ãŒå ±å‘Šã•ã‚Œã¦ã„ã¾ã™ãŒã€æœ¬è¨˜äº‹ã§ã¯è„†å¼±æ€§ CVE-2014-0224 ã‚’å–ã‚Šä¸Šã’ã¾ã™ã€‚IIJ ã§ã‚‚æœ¬è„†å¼±æ€§ã‚’èª¿æŸ»ã—ãŸçµæžœã€MITM æ”»æ’ƒãŒå¯èƒ½ã«ãªã‚‹ã«ã¯æ¡ä»¶ãŒã‚ã‚Šã¾ã™ã€‚ã—ãŸãŒã£ã¦ã€ä¾‹ãˆã°ä½¿ç”¨ã—ã¦ã„ã‚‹ OpenSSL ã®ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã‚„ SSL/TLS é€šä¿¡ã®åˆ©ç”¨ã®ä»•æ–¹ã«å¿œã˜ã¦ã€ã‚¢ãƒƒãƒ—ãƒ‡ãƒ¼ãƒˆã®ç·Šæ€¥æ€§ã‚’å€‹åˆ¥ã«æ¤œè¨Žã™ã‚‹ä½™åœ°ãŒã‚ã‚Šã¾ã™ã€‚ æ¦‚è¦ æœ¬è„†å¼±æ€§ã«ã‚ˆã‚‹ MITM æ”»æ’ƒ[1]MITM æ”»æ’ƒã¨ã¯ã€ã‚µãƒ¼ãƒã¨ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆã®é–“ã«æ”»æ’ƒè€…ãŒå‰²ã‚Šè¾¼ã¿ã€é€šä¿¡å†…å®¹ã®ç›—è´ã‚„æ”¹ã–ã‚“ã‚’è¡Œã†æ”»æ’ƒã§ã™ã€‚ã§ã¯ã€ã‚µãƒ¼ãƒã¨ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆã®ä¸¡æ–¹ãŒ OpenSSL ã‚’ä½¿ã£ã¦ã„ã‚‹å ´åˆã«ã€ãã®é–“ã«ã„ã‚‹æ”»æ’ƒè€…ãŒ SSL/TLS ãƒ
at_yasu 2014/06/08
MtMæ”»æ’ƒã§ãã‚‹è„†å¼±æ€§ã®è©±

iij

openssl

security
ãƒªãƒ³ã‚¯
OpenSSL SSL/TLS MITM vulnerability (CVE-2014-0224)
at_yasu 2014/06/06
6ä»¶ã®security fixã®è©±ã€‚

openssl

security
ãƒªãƒ³ã‚¯
OpenSSLè„†å¼±æ€§ã®å†ç™ºé˜²æ¢ã¸ã€æ¥ç•Œå¤§æ‰‹ãŒé‡è¦ã‚ªãƒ¼ãƒ—ãƒ³ã‚½ãƒ¼ã‚¹ãƒ—ãƒã‚¸ã‚§ã‚¯ãƒˆã‚’æ”¯æ´
Googleã‚„Microsoftã€å¯Œå£«é€šãªã©ã®å¤§æ‰‹ãŒå‚åŠ ã—ã¦ã€ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆã®ã‚¤ãƒ³ãƒ•ãƒ©ã‚’æ‹…ã†ã‚ªãƒ¼ãƒ—ãƒ³ã‚½ãƒ¼ã‚¹ãƒ—ãƒã‚¸ã‚§ã‚¯ãƒˆã‚’è³‡é‡‘é¢ã§ãƒãƒƒã‚¯ã‚¢ãƒƒãƒ—ã™ã‚‹ã€‚ ã‚ªãƒ¼ãƒ—ãƒ³ã‚½ãƒ¼ã‚¹ã®SSLï¼TLSæš—å·åŒ–ãƒ©ã‚¤ãƒ–ãƒ©ãƒªã€ŒOpenSSLã€ã«è‡´å‘½çš„ãªè„†å¼±æ€§ãŒè¦‹ã¤ã‹ã£ãŸã“ã¨ã‚’å—ã‘ã€Googleã‚„Microsoftã€IBMãªã©ã®æ¥ç•Œå¤§æ‰‹ãŒå‚åŠ ã—ã¦ã€ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆã®ã‚¤ãƒ³ãƒ•ãƒ©ã‚’æ‹…ã†ã‚ªãƒ¼ãƒ—ãƒ³ã‚½ãƒ¼ã‚¹ãƒ—ãƒã‚¸ã‚§ã‚¯ãƒˆã‚’è³‡é‡‘é¢ã§ãƒãƒƒã‚¯ã‚¢ãƒƒãƒ—ã™ã‚‹ã€ŒCore Infrastructure Initiativeã€ã‚’ç™ºè¶³ã•ã›ãŸã€‚Linux FoundationãŒ4æœˆ24æ—¥ã«ç™ºè¡¨ã—ãŸã€‚ Core Infrastructure Initiativeã«ã¯Amazon Web Servicesï¼ˆAWSï¼‰ã€Ciscoã€Dellã€Facebookã€å¯Œå£«é€šã€Googleã€IBMã€Intelã€Microsoftã€NetAppã€Rackspaceã€VMwareãª
at_yasu 2014/04/26
security

openssl
ãƒªãƒ³ã‚¯
Heartbleed ã§ã®æƒ…å ±å…¬é–‹ãƒ—ãƒã‚»ã‚¹ã«ã¯å•é¡ŒãŒã‚ã£ãŸ â€• OpenBSD ãŒ OpenSSL ã®ãƒ•ã‚©ãƒ¼ã‚¯ã€ŒLibreSSLã€ãƒ—ãƒã‚¸ã‚§ã‚¯ãƒˆã‚’ã‚¹ã‚¿ãƒ¼ãƒˆ [ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆã‚³ãƒ ]
OpenSSL ãƒ—ãƒã‚¸ã‚§ã‚¯ãƒˆã¯ Heartbleed è„†å¼±æ€§ã«ã‚ˆã‚Šã€æ‰¹åˆ¤ã«ã•ã‚‰ã•ã‚Œã¦ã„ã‚‹ã€‚OpenSSL Foundation ã¯é–‹ç™ºæŽ¨é€²ã®ãŸã‚ã®è³‡é‡‘æä¾›ã‚’å‘¼ã³æŽ›ã‘ã¦ã„ã‚‹ãŒã€OpenSSL ã‚’é€²åŒ–ã•ã›ã‚‹æ–°ãŸãªã‚ªãƒ—ã‚·ãƒ§ãƒ³ãŒç™»å ´ã—ãŸã€‚ OpenBSD ã‚³ãƒŸãƒ¥ãƒ‹ãƒ†ã‚£ãŒ OpenSSL ã‚³ãƒ¼ãƒ‰ã‚’ãƒ•ã‚©ãƒ¼ã‚¯ã—ã€ŒLibreSSLã€ã¨å‘¼ã°ã‚Œã‚‹æ–°ãŸãªæš—å·åŒ–ãƒ©ã‚¤ãƒ–ãƒ©ãƒªã®é–‹ç™ºã‚’ã‚¹ã‚¿ãƒ¼ãƒˆã•ã›ãŸã®ã ã€‚ Heartbleed ã«é–¢ã™ã‚‹ãƒ‹ãƒ¥ãƒ¼ã‚¹ãŒä¼ãˆã‚‰ã‚ŒãŸã¨ãã€ã‚ãŸã—ã¯ã€OpenBSD å‰µè¨è€…ã§ã‚ã‚‹ Theo de Raadt æ°ã«ã‚³ãƒ³ã‚¿ã‚¯ãƒˆã—ãŸã€‚De Raadt æ°ã¯çŽ‡ç›´ãªç‰©è¨€ã„ã§ã€å¸¸ã«èˆˆå‘³æ·±ã„ã‚³ãƒ¡ãƒ³ãƒˆã‚’æä¾›ã—ã¦ãã‚Œã‚‹äººç‰©ã ã€‚ ç§ã¯ Heartbleed è„†å¼±æ€§ã®æƒ…å ±å…¬é–‹ãƒ—ãƒã‚»ã‚¹ã«èˆˆå‘³ã‚’æŠ±ã„ã¦ã„ãŸã€‚Google ã‚„ CloudFlare ãªã©ã®é™ã‚‰ã‚ŒãŸã‚µãƒ¼ãƒ“ã‚¹ã¯ã€Heartbleed è„†å¼±æ€§ã«ã¤ã„ã¦äº‹å‰ã«é€šçŸ¥ã‚’å—ã‘ã¦
at_yasu 2014/04/23
openssl

OpenBSD

libreSSL
ãƒªãƒ³ã‚¯
OpenOpenSSL
the main OpenOpenSSL pageAbout OpenOpenSSL ProjectÂ Goals Hardware Platforms Daily Changelog Security Crypto Events Papers Press Commercial Support GettingÂ OpenOpenSSL CDs/T-shirts/Posters Getting Releases Installing OpenOpenSSL GettingÂ Source AnonCVS CVSync Web OpenOpenSSLÂ Resources Manuals FAQ Patches Reporting Mailing Lists Application Packages Books that Help SupportingÂ Open
at_yasu 2014/04/21
ã€ŒIETF, I don't trust you.ã€

security

SSL

OpenBSD

openssl
ãƒªãƒ³ã‚¯
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ›ãƒ¼ãƒ« memo - 2014.04
ã€‹ ãƒ”ãƒ¼ãƒãƒ»ã‚¢ãƒ“ã‚¨ãƒ¼ã‚·ãƒ§ãƒ³ MM252 ä¾¿ã€é‚£è¦‡ç©ºæ¸¯æ²–ã§é‡å¤§ã‚¤ãƒ³ã‚·ãƒ‡ãƒ³ãƒˆ ï¼œãŠè©«ã³ï¼ž4 æœˆ 28 æ—¥ MM252 ä¾¿ã®é‹èˆªã«ã¤ã„ã¦ (ãƒ”ãƒ¼ãƒãƒ»ã‚¢ãƒ“ã‚¨ãƒ¼ã‚·ãƒ§ãƒ³, 4/29) ãƒ”ãƒ¼ãƒ:é‚£è¦‡ç©ºæ¸¯ã§ç€é™¸ã‚’ç·Šæ€¥å›žé¿ã€€ä¹—å®¢ä¹—å“¡ã«ã‘ãŒãªã— (æ¯Žæ—¥, 4/29) ãƒ”ãƒ¼ãƒæ—…å®¢æ©Ÿã€Œé‡å¤§ã‚¤ãƒ³ã‚·ãƒ‡ãƒ³ãƒˆã€ã§èª¿æŸ»é–‹å§‹ (NHK, 4/29) ãƒ”ãƒ¼ãƒæ©Ÿé•·ã€Œé™ä¸‹æŒ‡ç¤ºã•ã‚ŒãŸã¨å‹˜é•ã„ã€ (NHK, 4/29) ç•°å¸¸é™ä¸‹ ç®¡åˆ¶å®˜ãŒé«˜åº¦ä½Žä¸‹ã‚’è¤‡æ•°å›žæ³¨æ„ (NHK, 4/30) æ€ã„è¾¼ã¿ã®ãƒ‘ãƒ¯ãƒ¼ã£ã¦åŠç«¯ãªã„ã‹ã‚‰ãªã‚ã€‚ ã€‹ å¤§è‡£è‡¨æ™‚ä¼šè¦‹æ¦‚è¦ (é˜²è¡›çœ, 4/28)ã€‚ã‚ªãƒ¼ã‚¹ãƒˆãƒ©ãƒªã‚¢è¨ªå•ã€‚é˜²è¡›è£…å‚™å”åŠ›ã®ä»¶ã€å…·ä½“çš„ã«å‡ºã¦ãã¦ã‚‹åå‰ã¯æ½œæ°´è‰¦ã¨ F-35ã€‚ ï¼±ï¼šé˜²è¡›è£…å‚™å”åŠ›ã«ã¤ã„ã¦ã¯ã€åŒã˜ã‚ˆã†ãªè£…å‚™ãŒã‚ã‚‹ã¨ã„ã†ã“ã¨ã§å”åŠ›ã—ã¦ã„ãã¨ã„ã†ã“ã¨ã§ã™ã‘ã‚Œã©ã‚‚ã€å…ˆæ–¹ã®æ–¹ã‹ã‚‰ã€å…·ä½“çš„ã«ã©ã†ã„ã£ãŸåˆ†é‡Žã§ã®å”åŠ›ã‚’è¦è«‹ã•ã‚ŒãŸã®ã§ã—ã‚‡ã†ã‹ã€‚ ï¼¡ï¼šä¾‹ãˆã°ã€æµ·ã®æ–¹ã§
at_yasu 2014/04/16
ã€Œã‚ãƒ£ãƒƒã‚·ãƒ¥ã®å„ªå…ˆåº¦è¨è¨ˆãŒ DNS ã®éšŽå±¤æ§‹é€ è¨è¨ˆã¨åˆ†é›¢ã•ã‚Œã¦ã„ã‚‹ (æ¨©å¨ã®æœ‰ç„¡ã—ã‹è€ƒãˆã¦ãªã„ã®ã§ã€æ¨©å¨ã‚’å½è£…ã™ã‚‹ã ã‘ã§æ‚ªã®é™ã‚Šã‚’å°½ã›ã‚‹)ã€ã¨ã„ã†ã®ãŒãã‚‚ãã‚‚ã®å•é¡Œãªã®ã‹ãªã‚ã€‚ã€

dns

security
ãƒªãƒ³ã‚¯
äººæ°—ã‚µã‚¤ãƒˆã¯â€œHeartbleedâ€ãƒ‘ãƒƒãƒæ¸ˆã¿ã€ãŸã ã—ä»¥å‰ã«æ¼ã‚ŒãŸå¯èƒ½æ€§ã‚‚ã€€
at_yasu 2014/04/15
ã€ŒSymantecã§ã¯ã€Heartbleedã®å•é¡Œã¯æ·±åˆ»ã ã¨ã—ãªãŒã‚‰ã‚‚ã€çµ‚æœ«çš„ãªã‚·ãƒŠãƒªã‚ªã¯è€ƒãˆã«ãã„ã¨ã¿ã¦ã„ã‚‹ã€‚ã€

Symantec

security

openssl
ãƒªãƒ³ã‚¯
Expired
Expiredï¼šæŽ²è¼‰æœŸé™åˆ‡ã‚Œã§ã™ ã“ã®è¨˜äº‹ã¯ï¼Œãƒã‚¤ã‚¿ãƒ¼ãƒ»ã‚¸ãƒ£ãƒ‘ãƒ³ ã¨ã®å¥‘ç´„ã®æŽ²è¼‰æœŸé™ï¼ˆ30æ—¥é–“ï¼‰ã‚’éŽãŽã¾ã—ãŸã®ã§æœ¬ã‚µãƒ¼ãƒã‹ã‚‰å‰Šé™¤ã—ã¾ã—ãŸã€‚ ã“ã®ãƒšãƒ¼ã‚¸ã¯20ç§’å¾Œã«ITmedia ãƒ‹ãƒ¥ãƒ¼ã‚¹ ãƒˆãƒƒãƒ—ãƒšãƒ¼ã‚¸ã«è‡ªå‹•çš„ã«åˆ‡ã‚Šæ›¿ã‚ã‚Šã¾ã™ã€‚
at_yasu 2014/04/10
security

openssl
ãƒªãƒ³ã‚¯
Heart Bleedã‚’èªã‚“ã - The first cry of Atom
int dtls1_process_heartbeat(SSL *s) { unsigned char *p = &s->s3->rrec.data[0], *pl; unsigned short hbtype; unsigned int payload; unsigned int padding = 16; /* Use minimum padding */ heartbeatã¨ã„ã†æ©Ÿèƒ½ã®è©³ã—ã„ã“ã¨ã¯èª¿ã¹ã‚‰ã‚Œã¦ã„ãªã„ã‘ã‚Œã©ã©ã†ã‚„ã‚‰ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆãƒ¼ã‚µãƒ¼ãƒåž‹ã®æ©Ÿèƒ½ã‚’æä¾›ã™ã‚‹ã‚‚ã®ã‚‰ã—ã„ã€‚ ã¤ã¾ã‚Šä½•ã‚‰ã‹ã®ãƒªã‚¯ã‚¨ã‚¹ãƒˆã‚’å—ã‘å–ã£ã¦ãƒ¬ã‚¹ãƒãƒ³ã‚¹ã‚’è¿”ã™ã‚ˆã†ãªã‚µãƒ¼ãƒ“ã‚¹ã‚’æä¾›ã™ã‚‹ã‚‚ã®ã‚‰ã—ã„ã€‚dtls1_process_heartbeatã§å¤§äº‹ãªã®ã¯ ãƒã‚¤ãƒ³ã‚¿pã ã€‚ã“ã‚Œã¯ãƒªã‚¯ã‚¨ã‚¹ãƒˆãƒ‡ãƒ¼ã‚¿ã‚’å—ã‘å–ã£ã¦æ ¼ç´ã—ã¦ã„ã‚‹ã€‚ã“ã®ãƒªã‚¯ã‚¨ã‚¹ãƒˆãƒ‡ãƒ¼ã‚¿ã¯æ§‹é€ ä½“ã«ãªã£ã¦ã„ã¦ã€ä»¥ä¸‹ã®ã‚ˆã†ã«è¨˜è¿°ã•ã‚Œã¦ã„ã‚‹ã€‚ typedef struct
at_yasu 2014/04/09
çã—ã„æ°—ãŒã™ã‚‹ã€‚ã“ã‚“ãªãƒŸã‚¹ã™ã‚‹ãªã‚“ã¦ã€‚

openssl

security
ãƒªãƒ³ã‚¯
Heartbleed Bug
The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library. This weakness allows stealing the information protected, under normal conditions, by the SSL/TLS encryption used to secure the Internet. SSL/TLS provides communication security and privacy over the Internet for applications such as web, em ail, instant messaging (IM) and some virtual private network
at_yasu 2014/04/08
openssl

security
ãƒªãƒ³ã‚¯
1 2 æ¬¡ã®ãƒšãƒ¼ã‚¸