[리눅스] 오픈SSL 취약점 확인(openssl)

오픈SSL 취약점 확인(openssl)

Heartbleed test URL : http://filippo.io/Heartbleed/

 

테스트 명령

openssl s_client -connect google.com:443 -tlsextdebug 2>&1

CONNECTED(00000003)
TLS server extension "renegotiation info" (id=65281), len=1
0001 - <SPACES/NULS>
TLS server extension "EC point formats" (id=11), len=4
0000 - 03 00 01 02                                       ....
TLS server extension "session ticket" (id=35), len=0
TLS server extension "heartbeat" (id=15), len=1
0000 - 01                                                .
depth=3 C = US, O = Equifax, OU = Equifax Secure Certificate Authority
verify return:1
depth=2 C = US, O = GeoTrust Inc., CN = GeoTrust Global CA
verify return:1
depth=1 C = US, O = Google Inc, CN = Google Internet Authority G2
verify return:1
depth=0 C = US, ST = California, L = Mountain View, O = Google Inc, CN = *.google.com
verify return:1
---

TLS에서 "heartbeat" (id=15) 기능을 제공할 경우 취약

 

참고URL

- https://github.com/FiloSottile/Heartbleed