0
0

【中危】启用了不安全的TLS1.0、TLS1.1协议

文章目录

1. 漏洞描述

TLS 1.0是于1996年发布的老版协议，使用的是弱加密算法和系统。比如SHA-1和MD5，这些算法和系统十分脆弱，存在重大安全漏洞，容易受到降级攻击的严重影响。
服务端口漏洞名称修复建议nginx443TLS版本1.0协议检测启用对TLS 1.2或1.3的支持，并禁用对TLS 1.0的支持nginx443TLS版本1.1协议检测启用对TLS 1.2或1.3的支持，并禁用对TLS 1.1的支持

2. 补充学习

  • TLS全称为：Transport Layer Security——安全传输层协议，用于在两个通信应用程序之间提供保密性和数据完整性。
  • 该协议由两层组成： TLS 记录协议（TLS Record）和 TLS 握手协议（TLS Handshake）。较低的层为 TLS 记录协议，位于某个可靠的传输协议（例如 TCP）上面。在这里插入图片描述
  • TLS 的最大优势就在于：TLS 是独立于应用协议。高层协议可以透明地分布在 TLS 协议上面。

知识点小灶：TLS详解

3. 漏洞检测

使用nmap网络安全审计工具（kail中有集成）
检测命令：

  1. nmap --script ssl-enum-ciphers -p 443 ip地址
  1. >nmap --script ssl-enum-ciphers -p 443192.168.1.100
  2. Starting Nmap 7.80( https://nmap.org ) at 2020-04-17 17:30 ?D1ú±ê×?ê±??
  3. Nmap scan report for localhost (192.168.1.100)
  4. Host is up (0.0089s latency).
  5.  
  6. PORT    STATE SERVICE
  7. 443/tcp open  https
  8. | ssl-enum-ciphers:
  9. |   TLSv1.0:
  10. |     ciphers:
  11. |       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (ecdh_x25519) - A
  12. |       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (ecdh_x25519) - A
  13. |       TLS_RSA_WITH_AES_256_CBC_SHA (rsa 1024) - A
  14. |       TLS_RSA_WITH_CAMELLIA_256_CBC_SHA (rsa 1024) - A
  15. |       TLS_RSA_WITH_AES_128_CBC_SHA (rsa 1024) - A
  16. |       TLS_RSA_WITH_CAMELLIA_128_CBC_SHA (rsa 1024) - A
  17. |     compressors:
  18. |       NULL
  19. |     cipher preference: server
  20. |   TLSv1.1:
  21. |     ciphers:
  22. |       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (ecdh_x25519) - A
  23. |       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (ecdh_x25519) - A
  24. |       TLS_RSA_WITH_AES_256_CBC_SHA (rsa 1024) - A
  25. |       TLS_RSA_WITH_CAMELLIA_256_CBC_SHA (rsa 1024) - A
  26. |       TLS_RSA_WITH_AES_128_CBC_SHA (rsa 1024) - A
  27. |       TLS_RSA_WITH_CAMELLIA_128_CBC_SHA (rsa 1024) - A
  28. |     compressors:
  29. |       NULL
  30. |     cipher preference: server
  31. |   TLSv1.2:
  32. |     ciphers:
  33. |       TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (ecdh_x25519) - A
  34. |       TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (ecdh_x25519) - A
  35. |       TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384 (ecdh_x25519) - A
  36. |       TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (ecdh_x25519) - A
  37. |       TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256 (ecdh_x25519) - A
  38. |       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (ecdh_x25519) - A
  39. |       TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384 (ecdh_x25519) - A
  40. |       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (ecdh_x25519) - A
  41. |       TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 (ecdh_x25519) - A
  42. |       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (ecdh_x25519) - A
  43. |       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (ecdh_x25519) - A
  44. |       TLS_RSA_WITH_AES_256_GCM_SHA384 (rsa 1024) - A
  45. |       TLS_RSA_WITH_AES_256_CCM_8 (rsa 1024) - A
  46. |       TLS_RSA_WITH_AES_256_CCM (rsa 1024) - A
  47. |       TLS_RSA_WITH_ARIA_256_GCM_SHA384 (rsa 1024) - A
  48. |       TLS_RSA_WITH_AES_128_GCM_SHA256 (rsa 1024) - A
  49. |       TLS_RSA_WITH_AES_128_CCM_8 (rsa 1024) - A
  50. |       TLS_RSA_WITH_AES_128_CCM (rsa 1024) - A
  51. |       TLS_RSA_WITH_ARIA_128_GCM_SHA256 (rsa 1024) - A
  52. |       TLS_RSA_WITH_AES_256_CBC_SHA256 (rsa 1024) - A
  53. |       TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256 (rsa 1024) - A
  54. |       TLS_RSA_WITH_AES_128_CBC_SHA256 (rsa 1024) - A
  55. |       TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256 (rsa 1024) - A
  56. |       TLS_RSA_WITH_AES_256_CBC_SHA (rsa 1024) - A
  57. |       TLS_RSA_WITH_CAMELLIA_256_CBC_SHA (rsa 1024) - A
  58. |       TLS_RSA_WITH_AES_128_CBC_SHA (rsa 1024) - A
  59. |       TLS_RSA_WITH_CAMELLIA_128_CBC_SHA (rsa 1024) - A
  60. |     compressors:
  61. |       NULL
  62. |     cipher preference: server
  63. |_  least strength: A
  64.  
  65. Nmap done: 1 IP address (1host up) scanned in5.55 seconds

4. 漏洞修复

采用2008年和2017年发布的协议新版本，分为TLS 1.2和TLS 1.3。

  1. # 原始配置#ssl_protocols TLSv1 TLSv1.1 TLSv1.2 ;# 修复配置
  2. ssl_protocols TLSv1.2 ;
  1. # HTTPS server#
  2.     server {
  3.         listen       443 ssl;
  4.         server_name  192.168.1.100;
  5.         keepalive_timeout  70;
  6.  
  7.         ssl_certificate      cert/mycert.pem;
  8.         ssl_certificate_key  cert/privatekey.pem;#ssl_certificate      cert/server.crt;#ssl_certificate_key  cert/server_rsa_private.pem.unsecure;
  9.  
  10.         ssl_session_cache    shared:SSL:1m;
  11.         ssl_session_timeout  5m;#ssl_protocols TLSv1 TLSv1.1 TLSv1.2 ;
  12.         ssl_protocols TLSv1.2 ;
  13.         ssl_ciphers  HIGH:!aNULL:!MD5;
  14.         ssl_prefer_server_ciphers  on;
  15.  
  16.         location / {
  17.             root   html;
  18.             index  index.html index.htm;}# 映射服务器集群
  19.         location /test/{
  20.             proxy_set_header  X-Real-IP        $remote_addr;
  21.             proxy_pass http://test;}
  22.         location /status{
  23.             stub_status on;}}

漏洞复测

  1. >nmap --script ssl-enum-ciphers -p 443192.168.1.100
  2. Starting Nmap 7.80( https://nmap.org ) at 2020-04-17 17:32 ?D1ú±ê×?ê±??
  3. Nmap scan report for localhost (192.168.1.100)
  4. Host is up (0.011s latency).
  5.  
  6. PORT    STATE SERVICE
  7. 443/tcp open  https
  8. | ssl-enum-ciphers:
  9. |   TLSv1.2:
  10. |     ciphers:
  11. |       TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (ecdh_x25519) - A
  12. |       TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (ecdh_x25519) - A
  13. |       TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384 (ecdh_x25519) - A
  14. |       TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (ecdh_x25519) - A
  15. |       TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256 (ecdh_x25519) - A
  16. |       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (ecdh_x25519) - A
  17. |       TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384 (ecdh_x25519) - A
  18. |       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (ecdh_x25519) - A
  19. |       TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 (ecdh_x25519) - A
  20. |       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (ecdh_x25519) - A
  21. |       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (ecdh_x25519) - A
  22. |       TLS_RSA_WITH_AES_256_GCM_SHA384 (rsa 1024) - A
  23. |       TLS_RSA_WITH_AES_256_CCM_8 (rsa 1024) - A
  24. |       TLS_RSA_WITH_AES_256_CCM (rsa 1024) - A
  25. |       TLS_RSA_WITH_ARIA_256_GCM_SHA384 (rsa 1024) - A
  26. |       TLS_RSA_WITH_AES_128_GCM_SHA256 (rsa 1024) - A
  27. |       TLS_RSA_WITH_AES_128_CCM_8 (rsa 1024) - A
  28. |       TLS_RSA_WITH_AES_128_CCM (rsa 1024) - A
  29. |       TLS_RSA_WITH_ARIA_128_GCM_SHA256 (rsa 1024) - A
  30. |       TLS_RSA_WITH_AES_256_CBC_SHA256 (rsa 1024) - A
  31. |       TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256 (rsa 1024) - A
  32. |       TLS_RSA_WITH_AES_128_CBC_SHA256 (rsa 1024) - A
  33. |       TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256 (rsa 1024) - A
  34. |       TLS_RSA_WITH_AES_256_CBC_SHA (rsa 1024) - A
  35. |       TLS_RSA_WITH_CAMELLIA_256_CBC_SHA (rsa 1024) - A
  36. |       TLS_RSA_WITH_AES_128_CBC_SHA (rsa 1024) - A
  37. |       TLS_RSA_WITH_CAMELLIA_128_CBC_SHA (rsa 1024) - A
  38. |     compressors:
  39. |       NULL
  40. |     cipher preference: server
  41. |_  least strength: A
  42.  
  43. Nmap done: 1 IP address (1host up) scanned in5.01 seconds

5. 片尾彩蛋

道路注定很漫长，但如果一味地等待，就永远不会到达终点。——白岩松

标签： 安全漏洞 漏洞复现 漏洞检测
本文转载自: https://blog.csdn.net/qq_36292543/article/details/119672523
版权归原作者 天泽岁月 所有， 如有侵权，请联系我们删除。
登录后发布评论

“【中危】启用了不安全的TLS1.0、TLS1.1协议”的评论:

还没有评论
关于作者
...
overfit同步小助手
文章同步
相关阅读

网络安全法-网络运行安全

使用selenium/drissionpage时如何阻止chrome自动跳转http到https

docker desktop 里部署的Open WebUI 管理员密码忘记了的处理方法

在ubuntu20.04中搭建onsite比赛运行环境

利用开源的低代码表单设计器FcDesigner高效管理和渲染复杂表单结构

Kafka学习笔记

【前端】浏览器输入url到页面呈现发生了什么？