流行的数据库管理系统（DBMS）Oracle MySQL 中发现了被称为“The Riddle”的编码漏洞，该漏洞允许攻击者利用MiTM（man-in-the-middle，中间人）来窃取用户的用户名和密码等登录凭证。用户请立即更新到5.7版本。
MiTM 攻击（Man-in-the-MiddleAttack）是一种“间接”的入侵攻击，这种攻击模式是通过各种技术手段将受入侵者控制的一台计算机虚拟放置在网络连接中的两台通信计算机之间，这台计算机就称为“中间人”。例如SMB会话劫持、DNS欺骗等攻击都是典型的MITM攻击。
Riddle漏洞是Oracle MySQL 5.5和5.6客户端数据库中发现的关键安全漏洞。该漏洞允许攻击者使用‘中间人攻击’来破坏MySQL客户端和服务器之间的SSL配置连接。这个漏洞是一个非常关键的安全漏洞，因为它影响到MySQL（一个非常流行的SQL数据库，SSL连接由其定义安全。）
该漏洞编号为“CVE-2017-3305”，可以潜在地将用户登录凭证暴露给攻击者，当MySQL客户端5.5和5.6将这些用户凭证信息发送到服务器时，攻击者就能够顺利捕获它们。
针对5.5.49和5.6.30版本发布的安全更新无法完全解决这一安全漏洞。5.7及更高版本以及MariaDB系统不受该安全问题的影响。
根据安全研究人员 Pali Rohár 所言，他们曾经尝试利用影响MySQL数据库的BACKRONYM漏洞的修补方式来修复Riddle漏洞，但是结果失败了。Backronym漏洞也同Riddle漏洞一样，允许攻击者运行中间人攻击来窃取用户登录凭证，即使流量已经被加密也无法阻止。
MySQL 5.5.49以及5.6.30 稳定版的安全更新包括在验证过程完成后添加安全参数的验证。因为验证完成后，攻击者可以使用中间人攻击与 SSL 降级攻击来窃取用户的登录数据，以便立即进行身份验证并登录 MySQL 服务器，可笑的部分是，MySQL 客户端不会在MySQL服务器拒绝验证用户时报告任何与 SSL 问题相关的错误，而是报告服务器发送的未加密的错误信息。此外，当中间人攻击处于活跃状态时，错误信息可以由攻击者控制。
安全专家建议用户尽快将客户端软件更新到MySQL 5.7 或 MariaDB，因为这些应用程序的安全更新正在正常运行，未受该安全漏洞影响。需要注意的是，这个漏洞虽然早在今年2月份就已经发现了，但是目前仍然在影响Oracle MySql软件。
如果你不是Oracle 用户，那么你对他们报告安全漏洞是无用的（即使确实是与安全相关的漏洞）。他们可以完全无视这些安全报告，甚至希望任何人都不要知道这些报告和漏洞的存在，所以至此他们都没有对漏洞进行修复。所以，立即向用户公开披露这些安全漏洞看来是最有效的解决方案，因为这样可以让用户知道一旦受影响应该做什么，有效的保护用户数据安全。
试用、下载、了解更多产品信息请点击"咨询在线客服"
C#: Pop3 pop = new Pop3(); |
VB.NET: Dim pop As Pop3 = New Pop3() |
C#: pop.Connect("mail.domain.com"); |
VB.NET: pop.Connect("mail.domain.com") |
C#: pop.Connect("127.0.0.1"); |
VB.NET: pop.Connect("127.0.0.1") |
C#: pop.Login("login", "password"); |
| VB.NET: pop.Login("login", "password") |
C#: MailMessage msg = pop.DownloadEntireMessage(pop.InboxMessageCount); |
| VB.NET: Dim msg As MailMessage = pop.DownloadEntireMessage(pop.InboxMessageCount) |
C#: pop.Disconnect(); |
| VB.NET: pop.Disconnect() |
C#: using System; using MailBee; using MailBee.Pop3Mail; using MailBee.Mime; namespace EmailApp { class Class1 { [STAThread] static bool IsNewMessage(string UID) { return true; } static void Main(string[] args) { Pop3 pop = new Pop3(); try { pop.Connect("mail.domain.com"); pop.Login("login", "password"); Console.WriteLine("Successfully logged in."); } catch(MailBeePop3LoginNegativeResponseException) { Console.WriteLine("POP3 server replied with a negative response at login."); } string[] arrIDs = pop.GetMessageUids(); int n = pop.InboxMessageCount; if (IsNewMessage(arrIDs[n])) { MailMessage msg = pop.DownloadEntireMessage(n); if (msg.BodyHtmlText != "") Console.WriteLine(msg.BodyHtmlText); else if (msg.BodyPlainText != "") Console.WriteLine(msg.BodyPlainText); else Console.WriteLine("The body of this message is empty."); } try { pop.Disconnect(); Console.WriteLine("Disconnected successfully."); } catch { Console.WriteLine("Disconnection failed."); } } } } |
| VB.NET: Imports System Imports MailBee Imports MailBee.Pop3Mail Imports MailBee.Mime Namespace EmailApp Class Class1 _ Shared Function IsNewMessage(ByVal UID As String) As Boolean Return True End Function Shared Sub Main(ByVal args() As String) Dim pop As Pop3 = New Pop3() Try pop.Connect("mail.domain.com") pop.Login("login", "password") Console.WriteLine("Successfully logged in.") Catch Console.WriteLine("POP3 server replied with a negative response at login.") End Try Dim arrIDs() As String = pop.GetMessageUids() Dim n As Integer = pop.InboxMessageCount If IsNewMessage(arrIDs(n)) Then Dim msg As MailMessage = pop.DownloadEntireMessage(n) If msg.BodyHtmlText <> "" Then Console.WriteLine(msg.BodyHtmlText) Else If msg.BodyPlainText <> "" Then Console.WriteLine(msg.BodyPlainText) Else Console.WriteLine("The body of this message is empty.") End If End If End If Try pop.Disconnect() Console.WriteLine("Disconnected successfully.") Catch Console.WriteLine("Disconnection failed.") End Try End Sub End Class End Namespace |
[PresentationContext(DicomUidType.VideoPhotographicImageStorage, DicomUidType.ImplicitVRLittleEndian,
DicomUidType.JPEG2000,
DicomUidType.JPEG2000LosslessOnly,
DicomUidType.JPEGBaseline1,
DicomUidType.JPEGExtended2_4,
DicomUidType.ExplicitVRBigEndian,
DicomUidType.ExplicitVRLittleEndian,
DicomUidType.JPEGLosslessNonhier14,
DicomUidType.JPEGLosslessNonhier14B,
DicomUidType.Mpeg4AvcH264BdCompatibleHighProfileLevel_4_1,
DicomUidType.Mpeg4AvcH264HighProfileLevel4_1)]
[PresentationContext(DicomUidType.VideoPhotographicImageStorage, DicomUidType.ImplicitVRLittleEndian,
DicomUidType.JPEG2000,
DicomUidType.JPEG2000LosslessOnly,
DicomUidType.JPEGBaseline1,
DicomUidType.JPEGExtended2_4,
DicomUidType.ExplicitVRBigEndian,
DicomUidType.ExplicitVRLittleEndian,
DicomUidType.JPEGLosslessNonhier14,
DicomUidType.JPEGLosslessNonhier14B,
DicomUidType.Mpeg4AvcH264BdCompatibleHighProfileLevel_4_1,
DicomUidType.Mpeg4AvcH264HighProfileLevel4_1,
DicomUidType.MPEG2MainProfileHighLevel,
DicomUidType.MPEG2MainProfileMainLevel)]
试用、下载、了解更多产品信息请点击"咨询在线客服"
C#
// Create SMTP object
Smtp mailer = new Smtp();
// Set the message fields.
mailer.From.AsString = "jdoe@domain.com";
mailer.To.AsString = "bill@domain2.com";
mailer.Subject = "Hi";
mailer.BodyPlainText = "This is test message";
// Starts logging SMTP activities into a file.
mailer.Log.Enabled = true;
mailer.Log.Filename = @"C:\log.txt";
mailer.Log.Clear();
// Specify the server to use. If your server does not require authentication,
// just omit both last parameters.
mailer.SmtpServers.Add("mail.domain.com", "jdoe", "secret");
// Attempt to connect.
mailer.Connect();
// Display the host name of the server the connection was established with.
Console.WriteLine("Connected to " + mailer.SmtpServers[mailer.GetCurrentSmtpServerIndex()].Name);
// Make sure all the recipients are ok.
if (mailer.TestSend(SendFailureThreshold.AllRecipientsFailed) != TestSendResult.OK)
{
Console.WriteLine("No recipients can receive the message.");
}// Show refused recipients if any
else if (mailer.GetRefusedRecipients().Count > 0)
{
Console.WriteLine("The following recipients failed: " + mailer.GetRefusedRecipients().ToString());
}
else
{
Console.WriteLine("All recipients are ok. Will send the message now.");
// Send e-mail. If it cannot be delivered, bounce will
// arrive to bounce@domain3.com, not to joe@domain1.com
mailer.Send("bounce@domain.com", (string)null);
Console.WriteLine("Sent to: " + mailer.GetAcceptedRecipients().ToString());
}
// Disconnect from the server
mailer.Disconnect();VB.NET
' Create SMTP object
Dim mailer As New Smtp
' Set the message fields.
mailer.From.AsString = "jdoe@domain.com"
mailer.To.AsString = "bill@domain2.com"
mailer.Subject = "Hi"
mailer.BodyPlainText = "This is test message"
' Starts logging SMTP activities into a file.
mailer.Log.Enabled = True
mailer.Log.Filename = "C:\log.txt"
mailer.Log.Clear()
' Specify the server to use. If your server does not require authentication,
' just remove last 2 parameters.
mailer.SmtpServers.Add("mail.domain.com", "jdoe", "secret")
' Attempt to connect.
mailer.Connect()
' Display the host name of the server the connection was established with.
Console.WriteLine("Connected to " + mailer.SmtpServers(mailer.GetCurrentSmtpServerIndex()).Name)
' Make sure all the recipients are ok.
If mailer.TestSend(SendFailureThreshold.AllRecipientsFailed) <> TestSendResult.OK Then
Console.WriteLine("No recipients can receive the message.")
Else
' Show refused recipients if any
If mailer.GetRefusedRecipients().Count > 0 Then
Console.WriteLine("The following recipients failed: " & mailer.GetRefusedRecipients().ToString())
Else
Console.WriteLine("All recipients are ok. Will send the message now.")
' Send e-mail. If it cannot be delivered, bounce will
' arrive to bounce@domain3.com, not to joe@domain1.com
mailer.Send("bounce@domain.com", CType(Nothing, String))
Console.WriteLine("Sent to: " + mailer.GetAcceptedRecipients().ToString())
End If
End If
' Disconnect from the server
mailer.Disconnect()试用、下载、了解更多产品信息请点击"咨询在线客服"
【慧都十四周年庆预热开启！全场满额送七级豪礼，AppleMac笔记本电脑、iwatch、iPad等您来拿！】
活动时间：10月1日-10月30日
沪公网安备31011202009668号 | 沪ICP备13020027号-2
