[B! è„†å¼±æ€§] mad-pã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

mad-p id:mad-p

è„†å¼±æ€§ã«é–¢ã™ã‚‹mad-pã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (4)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

OpenSSL #ccsinjection Vulnerability
[English] æœ€çµ‚æ›´æ–°æ—¥: Mon, 16 Jun 2014 18:21:23 +0900 CCS Injection Vulnerability æ¦‚è¦ OpenSSLã®ChangeCipherSpecãƒ¡ãƒƒã‚»ãƒ¼ã‚¸ã®å‡¦ç†ã«æ¬ é™¥ãŒç™ºè¦‹ã•ã‚Œã¾ã—ãŸã€‚ ã“ã®è„†å¼±æ€§ã‚’æ‚ªç”¨ã•ã‚ŒãŸå ´åˆã€æš—å·é€šä¿¡ã®æƒ…å ±ãŒæ¼ãˆã„ã™ã‚‹å¯èƒ½æ€§ãŒã‚ã‚Šã¾ã™ã€‚ ã‚µãƒ¼ãƒã¨ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆã®ä¸¡æ–¹ã«å½±éŸ¿ãŒã‚ã‚Šã€è¿…é€Ÿãªå¯¾å¿œãŒæ±‚ã‚ã‚‰ã‚Œã¾ã™ã€‚ æ”»æ’ƒæ–¹æ³•ã«ã¯å……åˆ†ãªå†ç¾æ€§ãŒã‚ã‚Šã€æ¨™çš„åž‹æ”»æ’ƒç‰ã«åˆ©ç”¨ã•ã‚Œã‚‹å¯èƒ½æ€§ã¯éžå¸¸ã«é«˜ã„ã¨è€ƒãˆã¾ã™ã€‚ å¯¾ç– å„ãƒ™ãƒ³ãƒ€ã‹ã‚‰æ›´æ–°ãŒãƒªãƒªãƒ¼ã‚¹ã•ã‚Œã‚‹ã¨æ€ã‚ã‚Œã‚‹ã®ã§ã€ãã‚Œã‚’ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«ã™ã‚‹ã“ã¨ã§å¯¾ç–ã§ãã¾ã™ã€‚ ï¼ˆéšæ™‚æ›´æ–°ï¼‰ Ubuntu Debian FreeBSD CentOS Red Hat 5 Red Hat 6 Amazon Linux AMI åŽŸå› OpenSSLã®ChangeCipherSpecãƒ¡ãƒƒã‚»ãƒ¼ã‚¸ã®å‡¦ç†ã«ç™ºè¦‹
mad-p 2014/06/05
OpenSSL MITMè„†å¼±æ€§(CCS Injection)ã®è§£èª¬ #ccsinjection

OpenSSL

security

è„†å¼±æ€§

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
Androidã®è„†å¼±æ€§ã‚’è¦‹ã¤ã‘ã¡ã‚ƒã£ãŸè©±
JVN#53768697 Android OS ã«ãŠã„ã¦ä»»æ„ã® Java ã®ãƒ¡ã‚½ãƒƒãƒ‰ãŒå®Ÿè¡Œã•ã‚Œã‚‹è„†å¼±æ€§ ãŒå…¬è¡¨ã•ã‚Œã¾ã—ãŸã€‚ ä¸è‚–ç§ãŒæ˜¨å¹´9æœˆã«IPAã«å±Šã‘å‡ºãŸã‚‚ã®ã§ã™ã€‚ ã“ã‚Œã¾ã§ã¯æƒ…å ±éžé–‹ç¤ºä¾é ¼ãŒã‚ã£ãŸã®ã§å¤šãã‚’èªžã‚‹ã“ã¨ãŒã§ãã¾ã›ã‚“ã§ã—ãŸã€‚ ãƒ¤ãƒã„å†…å®¹ãªã®ã§ã¿ã‚“ãªã«æ³¨æ„å–šèµ·ã—ãŸã‹ã£ãŸã‘ã‚Œã©ãã‚ŒãŒã§ããªã„è‹¦ã—ã•ã€‚ å‘¨ã‚Šã§ICSç«¯æœ«ã‚’ä½¿ã£ã¦ã‚‹äººã‚’è¦‹ã‹ã‘ãŸã‚‰ã€Œäº‹æƒ…ã¯è¨€ãˆãªã„ã‘ã©ãƒ–ãƒ©ã‚¦ã‚¶ã«ã¯Chromeã‚’ä½¿ã£ã¦ã€‚æ¨™æº–ãƒ–ãƒ©ã‚¦ã‚¶ä½¿ã‚ãªã„ã§ã€ã¨è¨€ã†ãã‚‰ã„ã—ã‹ã§ããªãã¦ç”³ã—è¨³ã‚ã‚Šã¾ã›ã‚“ã§ã—ãŸm(_ _)m å½“æ™‚ã®ã„ãã•ã¤ã‚’æ—¥è¨˜ã‹ã‚‰æŽ˜ã‚Šèµ·ã“ã—ã¦è¨˜éŒ²ã«æ®‹ã—ã¦ãŠããŸã„ã¨æ€ã„ã¾ã™ã€‚ 2012å¹´9æœˆ15æ—¥(åœŸ) WebViewã‚’ä½¿ã£ãŸãƒ“ã‚¸ãƒã‚¹ã‚¢ãƒ—ãƒªã®ãƒ•ãƒ¬ãƒ¼ãƒ ãƒ¯ãƒ¼ã‚¯ã‚’ä½œã‚ŠãŸã„ã¨ã„ã†æ§‹æƒ³ãŒã‚ã£ã¦ï¼ˆPhoneGapã«ã¯ãªã„ãƒ“ã‚¸ãƒã‚¹ç”¨ã®å›ºæœ‰ã®æ©Ÿèƒ½ã‚’å…¥ã‚Œã‚ˆã†ã¨æ€ã£ã¦ã€‚ãƒãƒ¼ã‚³ãƒ¼ãƒ‰ãƒªãƒ¼ãƒ€ãƒ¼ã¨ã‹å°åˆ·æ©Ÿèƒ½ã¨ã‹ï¼‰ã€ãã†ã„ãˆã° addJ
mad-p 2013/12/18
è„†å¼±æ€§ã‚’è¦‹ã¤ã‘ã¦ã—ã¾ã£ãŸã¨ãã©ã†å¯¾å¿œã—ãŸã‚‰ã„ã„ã‹ã€å‚è€ƒã«ãªã‚‹

è„†å¼±æ€§

android
ãƒªãƒ³ã‚¯
Ruby on Rails ã® Action Pack ã®ãƒ‘ãƒ©ãƒ¡ãƒ¼ã‚¿è§£æžã®è„†å¼±æ€§ã«ã‚ˆã‚Šä»»æ„ã®Rubyã‚³ãƒ¼ãƒ‰ã‚’å®Ÿè¡Œã•ã‚Œã‚‹è„†å¼±æ€§ï¼ˆCVE-2013-0156ï¼‰ã«é–¢ã™ã‚‹æ¤œè¨¼ãƒ¬ãƒãƒ¼ãƒˆ
Ruby on Rails ã® Action Pack ã®ãƒ‘ãƒ©ãƒ¡ãƒ¼ã‚¿è§£æžã®è„†å¼±æ€§ã«ã‚ˆã‚Šä»»æ„ã®Rubyã‚³ãƒ¼ãƒ‰ã‚’å®Ÿè¡Œã•ã‚Œã‚‹è„†å¼±æ€§ï¼ˆCVE-2013-0156ï¼‰ã«é–¢ã™ã‚‹æ¤œè¨¼ãƒ¬ãƒãƒ¼ãƒˆ Tweet 2013/01/24 NTTãƒ‡ãƒ¼ã‚¿å…ˆç«¯æŠ€è¡“æ ªå¼ä¼šç¤¾ è¾» ä¼¸å¼˜ å°æ¾ å¾¹ä¹Ÿ ã€æ¦‚è¦ã€‘ Ruby on Railsã«ã€ãƒªãƒ¢ãƒ¼ãƒˆã‚ˆã‚Šä»»æ„ã®ã‚³ãƒ¼ãƒˆã‚™ã‚’å®Ÿè¡Œã•ã‚Œã‚‹è„†å¼±æ€§ã‹ã‚™ç™ºè¦‹ã•ã‚Œã¾ã—ãŸã€‚ ã“ã®è„†å¼±æ€§ã¯ã€ãƒ‘ãƒ©ãƒ¡ãƒ¼ã‚¿è§£æžã«ãŠã‘ã‚‹YAMLãŠã‚ˆã³ã‚·ãƒ³ãƒœãƒ«å¤‰æ›ã®ä¸å‚™ã«èµ·å› ã—ã¾ã™ã€‚ã“ã®è„†å¼±æ€§ã‚’æ‚ªç”¨ã—ã¦ã€æ”»æ’ƒè€…ã¯ã‚¿ãƒ¼ã‚²ãƒƒãƒˆãƒ›ã‚¹ãƒˆä¸Šã«ã¦ã€å¥ªå–ã—ãŸãƒ¦ãƒ¼ã‚¶æ¨©é™ã§ä»»æ„ã®Rubyã‚³ãƒ¼ãƒ‰ã®å®Ÿè¡ŒãŒå¯èƒ½ã§ã™ã€‚ ä»Šå›žã€ã“ã®Ruby on Railsã®Action Packã®ãƒ‘ãƒ©ãƒ¡ãƒ¼ã‚¿è§£æžã®è„†å¼±æ€§ã«ã‚ˆã‚Šã€ä»»æ„ã®Rubyã‚³ãƒ¼ãƒ‰ã‚’å®Ÿè¡Œã•ã‚Œã‚‹è„†å¼±æ€§ï¼ˆCVE-2013-0156ï¼‰ã®å†ç¾æ€§ã«ã¤ã„ã¦æ¤œè¨¼ã‚’è¡Œã„ã¾ã—ãŸã€‚ æ¤œè¨¼ç’°å¢ƒã«ã¯ã€HTTPãƒªã‚¯ã‚¨ã‚¹ãƒˆã‚’å‡¦ç†ã™
mad-p 2013/01/25
rails

è„†å¼±æ€§

security

ruby

ruby on rails
ãƒªãƒ³ã‚¯
Unlha32.dllç‰é–‹ç™ºåœæ¢ã€LHAæ›¸åº«ã®ä½¿ç”¨ä¸æ¢å‘¼ã³ã‹ã‘ - Claybird ã®æ—¥è¨˜
ä»Šæ—¥ã§ã¯ã»ã¨ã‚“ã©ã®ã‚¦ã‚¤ãƒ«ã‚¹å¯¾ç–ã‚½ãƒ•ãƒˆãŒæ›¸åº«ãƒ•ã‚¡ã‚¤ãƒ«ã«å¯¾ã—ã‚¦ã‚¤ãƒ«ã‚¹ãƒã‚§ãƒƒã‚¯ã‚’è¡Œã†æ©Ÿèƒ½ã‚’å‚™ãˆã¦ã„ã‚‹ãŒã€å¤šãã®ã‚¦ã‚¤ãƒ«ã‚¹å¯¾ç–ã‚½ãƒ•ãƒˆã§ã€ŒLZHæ›¸åº«ãƒ•ã‚¡ã‚¤ãƒ«ã®ãƒ˜ãƒƒãƒ€ãƒ¼éƒ¨åˆ†ã«ç´°å·¥ã‚’æ–½ã™ã“ã¨ã§ã‚¦ã‚¤ãƒ«ã‚¹ãƒã‚§ãƒƒã‚¯ã‚’å›žé¿ã§ãã‚‹ã€ã¨ã„ã†è„†å¼±æ€§ãŒå˜åœ¨ã™ã‚‹ã¨ã®ã“ã¨ï¼ˆLZHæ›¸åº«ã®ãƒ˜ãƒƒãƒ€ãƒ¼å‡¦ç†ã«ãŠã‘ã‚‹è„†å¼±æ€§ã«ã¤ã„ã¦ï¼‰ã€‚ Miccoæ°ã¯ã“ã‚Œã‚’JVNï¼ˆJapan Vulnerability Noteã€JPCERTãŠã‚ˆã³IPAãŒå…±åŒé‹å–¶ã™ã‚‹è„†å¼±æ€§æƒ…å ±é›†ç©ã‚µã‚¤ãƒˆï¼‰ã«å ±å‘Šã—ãŸã¨ã“ã‚ã€ã€Œä¸å—ç†ã€ã¨ãªã£ãŸãã†ã ã€‚ZIPã‚„7zå½¢å¼ã®æ›¸åº«ã«ã‚‚åŒæ§˜ã®å•é¡ŒãŒã‚ã‚‹ã‚‚ã®ã®ã€ãã¡ã‚‰ã¯ã€Œè„†å¼±æ€§ã€ã¨ã—ã¦å—ç†ã•ã‚Œã¦ã„ã‚‹ã¨ã®ã“ã¨ã€‚Miccoæ°æ›°ãã€ ã€Œãƒ™ãƒ³ãƒ€ãƒ¼ï¼Œ JVN / IPA ç‰å…±ã«ã€ŽLZH æ›¸åº«ãªã‚“ã¦çŸ¥ã‚‰ãã‡ï½žã‚ˆã€ã¨ã„ã†æ…‹åº¦ã‹ã‚‰å¤‰ã‚ã‚‹ã“ã¨ã¯ãªã„ã€ã¨åˆ¤æ–ã§ãã¾ã—ãŸã®ã§ï¼Œ UNLHA32.DLLï¼Œ UNARJ32.DLLï¼Œ LHMelt ã®é–‹ç™ºã‚’ä¸æ¢ã™
mad-p 2010/06/07
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

LHA

è„†å¼±æ€§
ãƒªãƒ³ã‚¯
1

ãŠçŸ¥ã‚‰ã›

ã‚‚ã£ã¨èªã‚€

å…¬å¼Twitter

@hatebu
æœ€æ–°ã®äººæ°—ã‚¨ãƒ³ãƒˆãƒªãƒ¼ã®é…ä¿¡

ã‚ãƒ¼ãƒœãƒ¼ãƒ‰ã‚·ãƒ§ãƒ¼ãƒˆã‚«ãƒƒãƒˆä¸€è¦§

jæ¬¡ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

kå‰ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

lã‚ã¨ã§èªã‚€

eã‚³ãƒ¡ãƒ³ãƒˆä¸€è¦§ã‚’é–‹ã

oãƒšãƒ¼ã‚¸ã‚’é–‹ã

è¨å®šã‚’å¤‰æ›´ã—ã¾ã—ãŸx

ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

ã‚¿ã‚°

é–¢é€£ã‚¿ã‚°ã§çµžã‚Šè¾¼ã‚€ (8)

è„†å¼±æ€§ã«é–¢ã™ã‚‹mad-pã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (4)

ãŠçŸ¥ã‚‰ã›

ä»Šé€±ã®ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚ãƒ³ã‚°ï¼ˆ2024å¹´12æœˆç¬¬1é€±ï¼‰

æœˆé–“ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚ãƒ³ã‚°ï¼ˆ2024å¹´11æœˆï¼‰

ä»Šé€±ã®ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚ãƒ³ã‚°ï¼ˆ2024å¹´11æœˆç¬¬5é€±ï¼‰

å…¬å¼Twitter

ã‚ãƒ¼ãƒœãƒ¼ãƒ‰ã‚·ãƒ§ãƒ¼ãƒˆã‚«ãƒƒãƒˆä¸€è¦§

ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

å…¬å¼Twitter

ã¯ã¦ãªã®ã‚µãƒ¼ãƒ“ã‚¹

ã‚¿ã‚°

é–¢é€£ã‚¿ã‚°ã§çµžã‚Šè¾¼ã‚€ (8)

è„†å¼±æ€§ã«é–¢ã™ã‚‹mad-pã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (4)

OpenSSL #ccsinjection Vulnerability

Androidã®è„†å¼±æ€§ã‚’è¦‹ã¤ã‘ã¡ã‚ƒã£ãŸè©±

Unlha32.dllç­‰é–‹ç™ºåœæ­¢ã€LHAæ›¸åº«ã®ä½¿ç”¨ä¸­æ­¢å‘¼ã³ã‹ã‘ - Claybird ã®æ—¥è¨˜

ãŠçŸ¥ã‚‰ã›

ä»Šé€±ã®ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚­ãƒ³ã‚°ï¼ˆ2024å¹´12æœˆç¬¬1é€±ï¼‰

æœˆé–“ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚­ãƒ³ã‚°ï¼ˆ2024å¹´11æœˆï¼‰

ä»Šé€±ã®ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚­ãƒ³ã‚°ï¼ˆ2024å¹´11æœˆç¬¬5é€±ï¼‰

å…¬å¼Twitter

ã‚­ãƒ¼ãƒœãƒ¼ãƒ‰ã‚·ãƒ§ãƒ¼ãƒˆã‚«ãƒƒãƒˆä¸€è¦§

ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

å…¬å¼Twitter

ã¯ã¦ãªã®ã‚µãƒ¼ãƒ“ã‚¹

é–¢é€£ã‚¿ã‚°ã§çµžã‚Šè¾¼ã‚€ (8)

è„†å¼±æ€§ã«é–¢ã™ã‚‹mad-pã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (4)

Androidã®è„†å¼±æ€§ã‚’è¦‹ã¤ã‘ã¡ã‚ƒã£ãŸè©±

Unlha32.dllç‰é–‹ç™ºåœæ¢ã€LHAæ›¸åº«ã®ä½¿ç”¨ä¸æ¢å‘¼ã³ã‹ã‘ - Claybird ã®æ—¥è¨˜

ãŠçŸ¥ã‚‰ã›

ä»Šé€±ã®ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚ãƒ³ã‚°ï¼ˆ2024å¹´12æœˆç¬¬1é€±ï¼‰

æœˆé–“ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚ãƒ³ã‚°ï¼ˆ2024å¹´11æœˆï¼‰

ä»Šé€±ã®ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚ãƒ³ã‚°ï¼ˆ2024å¹´11æœˆç¬¬5é€±ï¼‰

å…¬å¼Twitter

ã‚ãƒ¼ãƒœãƒ¼ãƒ‰ã‚·ãƒ§ãƒ¼ãƒˆã‚«ãƒƒãƒˆä¸€è¦§

ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

å…¬å¼Twitter

ã¯ã¦ãªã®ã‚µãƒ¼ãƒ“ã‚¹