inliniac/suricata — pull request #923 by chifflier (2014-04-09 08:02:47+00:00)
Title: TLS: add detection for malicious heartbeats (AKA heartbleed)

The OpenSSL implementation of RFC 6520 (Heartbeat extension) does not
check the payload length correctly, resulting in a copy of at most 64k
of memory from the server (ref: CVE-2014-0160).
This patch adds support for decoding heartbeat messages (if not
encrypted), and checking several parts (type, length and padding).
When an anomaly is detected, a TLS event is raised.
For ex., the following rules can be added:

alert tls any any -> any any (msg:"SURICATA TLS overflow heartbeat
encountered, possible exploit attempt (heartbleed)"; flow:established;
app-layer-event:tls.overflow_heartbeat_message;
flowint:tls.anomaly.count,+,1; classtype:protocol-command-decode;
reference:cve,2014-0160; sid:2230010; rev:1;)

alert tls any any -> any any (msg:"SURICATA TLS heartbeat encountered";
flow:established; app-layer-event:tls.heartbeat_message;
flowint:tls.anomaly.count,+,1; classtype:protocol-command-decode;
sid:2230011; rev:1;)