Board logo

标题: POODLE:SSLv3 漏洞 [打印本页]

作者: 合肥亮少    时间: 2016-3-3 15:08     标题: POODLE:SSLv3 漏洞

故障现象:

Lenovo 安全公告:LEN-2014-007

潜在影响:未经授权的访问;中间人(MitM)攻击

重要性

摘要:

Lenovo 公开宣布,一个名为 POODLE 的安全漏洞仅会对少量的连网设备带来影响。但是,该漏洞非常严重,攻击者可能会利用此漏洞读取加密信息,甚至是在通过 SSL 连接进行传输时也不例外。Lenovo 为您列出了相关步骤,可帮助您进行自我保护。


解决方案:

应采取哪些措施进行自我保护:

将浏览器升级到您的 IT 组织支持的最新版本。如果正在使用 Internet Explorer 6,请改用更先进且版本受支持的浏览器。

禁用浏览器内的 SSLv3 支持。可转至此处,查找 SSLv3“Yes”,从而查看浏览器是否容易遭受攻击。要禁用 SSLv3 支持,请进行以下更改并重新启动浏览器:

Mozilla Firefox

打开 about:config,找到 security.tls.version.min 并将值设置为 1。

Google Chrome

较新的 Chrome 版本支持 TLS_FALLBACK_SCSV,从而能够缓解这一问题。

可通过发出命令行命令 ssl-version-min=tls1 来显式禁用 SSLv3 支持。可在此处找到关于使用命令行标记的进一步说明。

Internet Explorer

转至“Internet 选项”下的“高级”选项卡,然后取消选中 SSLv3。

使用可用工具,对您的基础结构进行扫描,以查找是否存在此漏洞。Tinfoil SecuritySSL Labs 提供了两种可用工具。

对通过发送电子邮件向您的设备安装补丁的投机钓鱼者提高警惕。请勿点击看似可疑的链接。

一般来讲,减少恶意攻击者可利用的表面积不失为一种好的做法,因此在可能的情况下,请禁用 Web 服务器等不必要的服务。

如果您无法禁用使用 SSLv3 的 Web 服务器,请应用网络分段和适当的访问控制列表来限制远程访问,从而最大程度降低影响。

请查看下方的“产品影响”列表,并更新适用的固件。

产品影响:

ThinkPad

系统

状态

最低 Intel Management Engine 固件版本,

包括修复程序

链接

ThinkPad Edge E130

未受影响

ThinkPad Edge E145

未受影响

ThinkPad Edge E431/E531

未受影响

ThinkPad Edge E440/E540

未受影响

ThinkPad Edge E455/E555

未受影响

ThinkPad Edge S430

未受影响

ThinkPad Helix(20CG、20CH)

受到影响

ME FW 10.0.38.1000

http://support.lenovo.com/us/en/products/laptops-and-netbooks/thinkpad-helix-series-laptops/thinkpad-helix-type-20cg-20ch/downloads/DS101498

ThinkPad Helix(3xxx)

受到影响

ME FW 8.1.60.1561

http://support.lenovo.com/us/en/products/laptops-and-netbooks/thinkpad-helix-series-laptops/thinkpad-helix-type-3xxx/downloads/DS032435

ThinkPad L430/L530

未受影响

ThinkPad L440/L540

未受影响

ThinkPad S1 Yoga(非 vPro)

未受影响

ThinkPad S1 Yoga(vPro)

未受影响

ThinkPad S431

未受影响

ThinkPad S440

未受影响

ThinkPad S531

未受影响

ThinkPad S540

未受影响

ThinkPad T430

受到影响

ME FW 8.1.60.1561

http://support.lenovo.com/us/en/downloads/DS032435

ThinkPad T430i/T430s/T430si

受到影响

ME FW 8.1.60.1561

http://support.lenovo.com/us/en/downloads/DS032435

ThinkPad T430u

未受影响

ThinkPad T431s

受到影响

ME FW 8.1.60.1561

http://support.lenovo.com/us/en/downloads/DS032435

ThinkPad T440/T440s

受到影响

ME FW 9.5.45.1922

http://support.lenovo.com/us/en/downloads/DS038194

ThinkPad T440p

受到影响

ME FW 9.1.25.1005

http://support.lenovo.com/us/en/downloads/DS037583

ThinkPad T530/T530i

受到影响

ME FW 8.1.60.1561

http://support.lenovo.com/us/en/downloads/DS032435

ThinkPad T540p

受到影响

ME FW 9.1.25.1005

http://support.lenovo.com/us/en/downloads/DS037583

ThinkPad Tablet 10(32 位)

未受影响

ThinkPad Tablet 10(64 位)

未受影响

ThinkPad Tablet 2

未受影响

ThinkPad Tablet 8(32 位)

未受影响

ThinkPad Tablet 8(64 位)

未受影响

ThinkPad Twist/Edge S230

未受影响

ThinkPad W530

受到影响

ME FW 8.1.60.1561

http://support.lenovo.com/us/en/downloads/DS032435

ThinkPad W540

受到影响

ME FW 9.1.25.1005

http://support.lenovo.com/us/en/downloads/DS037583

ThinkPad W550s

受到影响

ME FW 10.0.38.1000

http://support.lenovo.com/us/en/downloads/DS101498

ThinkPad X1 Carbon(20A7、20A8)

受到影响

ME FW 9.5.45.1922

http://support.lenovo.com/us/en/downloads/DS038194

ThinkPad X1 Carbon(20BS、20BT)

受到影响

ME FW 10.0.38.1000

http://support.lenovo.com/us/en/downloads/DS101498

ThinkPad X1 Carbon(34xx)

受到影响

ME FW 8.1.60.1561

http://support.lenovo.com/us/en/downloads/DS032435

ThinkPad X131e(AMD)

未受影响

ThinkPad X131e(Intel)

未受影响

ThinkPad X140e(AMD)

未受影响

ThinkPad X230/X230i

受到影响

ME FW 8.1.60.1561

http://support.lenovo.com/us/en/downloads/DS032435

ThinkPad X230s

受到影响

ME FW 8.1.60.1561

http://support.lenovo.com/us/en/downloads/DS032435

ThinkPad X230 平板电脑

受到影响

ME FW 8.1.60.1561

http://support.lenovo.com/us/en/downloads/DS032435

ThinkPad X240/X240s

受到影响

ME FW 9.5.45.1922

http://support.lenovo.com/us/en/downloads/DS038194

ThinkPad X250

受到影响

ME FW 10.0.38.1000

http://support.lenovo.com/us/en/downloads/DS101498

ThinkPad Yoga 11e

未受影响

ThinkCentre:

系统

状态

最低 Intel Management Engine 固件版本,

包括修复程序

链接

ThinkCentre E73Z

未受影响

ThinkCentre E93

受到影响

ME FW 9.1.25

http://support.lenovo.com/us/en/products/desktops-and-all-in-ones/thinkcentre-m-series-desktops/thinkcentre-m93/downloads/DS040196

ThinkCentre E93Z

未受影响

ThinkCentre Edge 62z

未受影响

ThinkCentre Edge 72

未受影响

ThinkCentre Edge 72z

未受影响

ThinkCentre Edge 92z

未受影响

ThinkCentre M62Z

未受影响

ThinkCentre M72e

未受影响

ThinkCentre M72e

未受影响

ThinkCentre M72e

未受影响

ThinkCentre M72z

未受影响

ThinkCentre M73

未受影响

ThinkCentre M73 Tiny

未受影响

ThinkCentre M73Z

未受影响

ThinkCentre M78(类型 1562、1565、1662、1663、1766、2111、2113、2114、4860、4863、4865、4866、5100)

未受影响

ThinkCentre M78(类型 10BN、10BQ、10BR、10BS、10BT、10BU)

未受影响

ThinkCentre M83Z

未受影响

ThinkCentre M90

未受影响

ThinkCentre M90p

未受影响

ThinkCentre M91

未受影响

ThinkCentre M91P

未受影响

ThinkCentre M92

受到影响

ME FW 8.1.60

http://support.lenovo.com/us/en/downloads/DS102620

ThinkCentre M92P

受到影响

ME FW 8.1.60

http://support.lenovo.com/us/en/downloads/DS102620

ThinkCentre M92Z

受到影响

ME FW 8.1.60

http://support.lenovo.com/us/en/downloads/DS102620

ThinkCentre M93

受到影响

ME FW 9.1.25

http://support.lenovo.com/us/en/products/desktops-and-all-in-ones/thinkcentre-m-series-desktops/thinkcentre-m93/downloads/DS040196

ThinkCentre M93P

受到影响

ME FW 9.1.25

http://support.lenovo.com/us/en/products/desktops-and-all-in-ones/thinkcentre-m-series-desktops/thinkcentre-m93/downloads/DS040196

ThinkCentre M93Z

受到影响

ME FW 9.1.25

http://support.lenovo.com/us/en/products/desktops-and-all-in-ones/thinkcentre-m-series-desktops/thinkcentre-m93/downloads/DS040196

ThinkStation:

系统

状态

最低版本,

包括修复程序

链接

ThinkStation C30

(类型 1136、1137)

受到影响

ME FW 8.1.60

http://support.lenovo.com/us/en/downloads/DS102620

ThinkStation D30

(类型 4353、4354)

受到影响

ME FW 8.1.60

http://support.lenovo.com/us/en/downloads/DS102620

ThinkStation E31

受到影响

ME FW 8.1.60

http://support.lenovo.com/us/en/downloads/DS102620

ThinkStation E32

受到影响

ME FW 9.1.25

http://support.lenovo.com/us/en/downloads/DS040196

ThinkStation P300

受到影响

ME FW 9.1.25

http://support.lenovo.com/us/en/downloads/DS040196

ThinkStation P500

受到影响

ME FW 9.1.25

http://support.lenovo.com/us/en/downloads/DS040196

ThinkStation P700

受到影响

ME FW 9.1.25

http://support.lenovo.com/us/en/downloads/DS040196

ThinkStation P900

受到影响

ME FW 9.1.25

http://support.lenovo.com/us/en/downloads/DS040196

ThinkStation S30

(类型 4351、4352)

受到影响

ME FW 8.1.60

http://support.lenovo.com/us/en/downloads/DS102620

ThinkServer & Storage:

系统

状态

最低底板管理控制器(BMC)版本,

包括修复程序

发布网址

ThinkServer RD330

受到影响

23.00

http://support.lenovo.com/us/en/products/servers/thinkserver-rack-servers/thinkserver-rd330/downloads/DS033567

ThinkServer RD340

受到影响

24.00

http://support.lenovo.com/us/en/products/servers/thinkserver-rack-servers/thinkserver-rd340/downloads/DS039950

ThinkServer RD350

受到影响

1.42

http://support.lenovo.com/us/en/products/servers/thinkserver-rack-servers/thinkserver-rd350/downloads/DS102390

ThinkServer RD430

受到影响

23.00

http://support.lenovo.com/us/en/products/servers/thinkserver-rack-servers/thinkserver-rd430/downloads/DS033570

ThinkServer RD440

受到影响

24.00

http://support.lenovo.com/us/en/products/servers/thinkserver-rack-servers/thinkserver-rd440/downloads/DS039970

ThinkServer RD450

受到影响

1.42

http://support.lenovo.com/us/en/products/servers/thinkserver-rack-servers/thinkserver-rd450/downloads/DS102390

ThinkServer RD530

受到影响

23.00

http://support.lenovo.com/us/en/products/servers/thinkserver-rack-servers/thinkserver-rd530/downloads/DS032645

ThinkServer RD540

受到影响

24.00

http://support.lenovo.com/us/en/products/servers/thinkserver-rack-servers/thinkserver-rd540/downloads/DS038485

ThinkServer RD550

受到影响

1.42

http://support.lenovo.com/us/en/products/servers/thinkserver-rack-servers/thinkserver-rd550/downloads/DS102390

ThinkServer RD630

受到影响

23.00

http://support.lenovo.com/us/en/products/servers/thinkserver-rack-servers/thinkserver-rd530/downloads/DS032645

ThinkServer RD640

受到影响

24.00

http://support.lenovo.com/us/en/products/servers/thinkserver-rack-servers/thinkserver-rd630/downloads/DS032686

ThinkServer RD650

受到影响

1.42

http://support.lenovo.com/us/en/products/servers/thinkserver-rack-servers/thinkserver-rd650/downloads/DS102390

ThinkServer RS140

未受影响

ThinkServer TD340

受到影响

20.00

http://support.lenovo.com/us/en/products/servers/thinkserver-tower-servers/thinkserver-td340/downloads/DS040193

ThinkServer TD350

受到影响

1.42

http://support.lenovo.com/us/en/products/servers/thinkserver-rack-servers/thinkserver-rd350/downloads/DS102390

ThinkServer TS130

未受影响

ThinkServer TS140

未受影响

ThinkServer TS430

未受影响

ThinkServer TS440

未受影响

ThinkStorage SA120

未受影响

LenovoEMC:

系统

状态

最低 Lifeline 版本,包括修复程序

链接

LenovoEMC EZ Media & Backup(hm3)

受到影响

4.1.106.31982

https://lenovo-na-en.custhelp.com/app/answers/detail/a_id/34897

LenovoEMC Home Media Cloud Edition(hm2)

受到影响

3.2.10.30101

http://lenovo-na-en.custhelp.com/app/answers/detail/a_id/26791

LenovoEMC ix12-300r

受到影响

4.0.12.31480

https://lenovo-eu-en.custhelp.com/app/answers/detail/a_id/23142

LenovoEMC ix2(包括 DL)

受到影响

4.1.106.31982

https://lenovo-na-en.custhelp.com/app/answers/detail/a_id/34897

LenovoEMC ix2-200

受到影响

2.1.44.30050

https://lenovo-na-en.custhelp.com/app/answers/detail/a_id/22318

LenovoEMC ix2-200 Cloud Edition

受到影响

3.2.10.30101

http://lenovo-na-en.custhelp.com/app/answers/detail/a_id/26789

LenovoEMC ix4-200d

受到影响

2.1.44.30050

https://lenovo-na-en.custhelp.com/app/answers/detail/a_id/22318

LenovoEMC ix4-200d(2.1.x 固件)

受到影响

2.1.44.30050

https://lenovo-na-en.custhelp.com/app/answers/detail/a_id/22318

LenovoEMC ix4-200d Cloud Edition

受到影响

3.2.10.30101

http://lenovo-na-en.custhelp.com/app/answers/detail/a_id/26784

LenovoEMC ix4-300d(包括 DL)

受到影响

4.1.106.31982

https://lenovo-na-en.custhelp.com/app/answers/detail/a_id/34897

LenovoEMC px12-350r

受到影响

4.0.12.31480

https://lenovo-eu-en.custhelp.com/app/answers/detail/a_id/23142

LenovoEMC px12-400r

受到影响

4.1.106.31982

https://lenovo-na-en.custhelp.com/app/answers/detail/a_id/34897

LenovoEMC px12-450r

受到影响

4.1.106.31982

https://lenovo-na-en.custhelp.com/app/answers/detail/a_id/34897

LenovoEMC px2-300d(包括 NVR)

受到影响

4.1.106.31982

https://lenovo-na-en.custhelp.com/app/answers/detail/a_id/34897

LenovoEMC px4-300d(包括 NVR)

受到影响

4.1.106.31982

https://lenovo-na-en.custhelp.com/app/answers/detail/a_id/34897

LenovoEMC px4-300r

受到影响

4.1.106.31982

https://lenovo-na-en.custhelp.com/app/answers/detail/a_id/34897

LenovoEMC px4-400d(包括 NVR)

受到影响

4.1.106.31982

https://lenovo-na-en.custhelp.com/app/answers/detail/a_id/34897

LenovoEMC px4-400r

受到影响

4.1.106.31982

https://lenovo-na-en.custhelp.com/app/answers/detail/a_id/34897

LenovoEMC px6-300d

受到影响

4.1.106.31982

https://lenovo-na-en.custhelp.com/app/answers/detail/a_id/34897

软件:

应用程序

状态

最低版本,

包括修复程序

链接

Deploy Manager

未受影响

Diagnostic

未受影响

Easy Manager

未受影响

Easy Updater

未受影响

Energy Manager

受到影响

1.1

http://support.lenovo.com/us/en/downloads/ds101160

OSPUT

未受影响

Partner Pack

受到影响

2

http://support.lenovo.com/us/en/downloads/ds101158

Power Planner

未受影响

TSMCLI

受到影响

1.1.1

http://support.lenovo.com/us/en/downloads/ds101157


备注:

致谢:

其他信息和参考资料:

CVE ID:CVE-2014-3566CVE-2014-8730


修订历史:

版本

日期

描述

1.5

2015-09-28

更新的 ThinkServer 修复版本,可补充之前不完整的修复程序

1.4

2015-06-29

发布其他修复程序

1.3

2015-05-17

发布其他修复程序

1.2

2015-04-16

发布其他修复程序

1.1

2015-03-03

发布其他修复程序

1.0

2014-12-24

初始版本







欢迎光临 合肥本本之星 合肥Thinkpad专卖店 合肥Apple专卖店 hfthink 合肥本之星信息科技有限公司 (http://hfthink.com/) Powered by Discuz! 7.2