Firmaet Qualys har identificeret en kritisk s\u00e5rbarhed (CVE-2024-6387) i OpenSSH, som muligg\u00f8r fjernk\u00f8rsel af kode med root-rettigheder uden godkendelse. S\u00e5rbarheden, der har kodenavnet regreSSHion, optr\u00e6der i standardkonfigurationen fra version 8.5 af OpenSSH p\u00e5 systemer med den standardbibliotek Glibc. <\/p>\n
Muligheden for angreb blev demonstreret p\u00e5 et 32-bit system med Glibc med aktiveret ASLR-beskyttelse (Randomisering af adresseplads). For at gennemf\u00f8re et angreb under laboratoriebetingelser kr\u00e6vedes 6-8 timer, hvor serveren<\/a> uafbrudt havde forbindelser med maksimal intensitet tilladt i sshd-konfigurationen. Angrebet forenkles og kr\u00e6ver mindre tid p\u00e5 systemer uden ASLR eller i distributioner, der bruger en modificeret version af OpenSSH, hvor den gentagne randomisering af ASLR for hver forbindelse er deaktiveret. Beslutningen om ikke at offentligg\u00f8re en fungerende prototype af exploit f\u00f8r s\u00e5rbarheden er bredt udbedret er taget, men der er tilg\u00e6ngelig en tilstr\u00e6kkelig detaljeret beskrivelse af s\u00e5rbarhedens essens, som g\u00f8r fremkomsten af tredjeparts exploits til et sp\u00f8rgsm\u00e5l om tid.<\/p>\n Muligheden for at udf\u00f8re angreb p\u00e5 64-bit systemer udelukkes ikke, men en fungerende exploit til s\u00e5danne systemer er endnu ikke klar. Det antages, at det at udf\u00f8re angreb p\u00e5 64-bit systemer vil tage betydeligt l\u00e6ngere tid, men ikke mere end en uge. OpenSSH i OpenBSD er ikke p\u00e5virket af problemet, da dette system siden 2001 har anvendt en beskyttelsesmekanisme, der blokerer for s\u00e5danne typer angreb. I andre systemer baseret p\u00e5 standardbiblioteker, der adskiller sig fra Glibc, er det teoretisk muligt at tilpasse metoden til angreb (dette sp\u00f8rgsm\u00e5l er endnu ikke unders\u00f8gt af Qualys). <\/p>\n S\u00e5rbarheden er blevet rettet i den i dag offentliggjorte version af OpenSSH 9.8 (patch). Hold \u00f8je med offentligg\u00f8relsen af opdateringer til pakker i distributionerne p\u00e5 siderne: Debian, Ubuntu, RHEL, SUSE\/openSUSE, Fedora, ROSA, Gentoo, ALT Linux, Arch og FreeBSD. Som en midlertidig l\u00f8sning p\u00e5 s\u00e5rbarheden i sshd_config kan parameteren \u00abLoginGraceTime=0\u00bb s\u00e6ttes, mens deaktivering af timeout'en vil lette initieringen af denial-of-service ved at etablere et stort antal forbindelser, der overstiger gr\u00e6nserne angivet gennem parameteren MaxStartups. S\u00e5rbarheden opstod som f\u00f8lge af et regressivt \u00e6ndringsforslag, der blev inkluderet i udgivelsen af OpenSSH 8.5, hvilket f\u00f8rte til en race condition i kodeh\u00e5ndteringen af signaler i sshd. Regressionen resulterede i, at beskyttelsen mod den gamle s\u00e5rbarhed CVE-2006-5051, der blev manifesteret indtil version 4.4 (2006), ikke l\u00e6ngere fungerede og havde en teoretisk karakter. SIGALRM-handleren kaldes i sshd asynkront, hvis klienten ikke har gennemf\u00f8rt autentificering inden for den tid, der er begr\u00e6nset af forbindelsens timeout (LoginGraceTime, som standard 120 sekunder). Angrebet er baseret p\u00e5, at signalhandleren kalder funktioner, der ikke er sikre ved asynkron h\u00e5ndtering af signaler, s\u00e5som syslog(). Funktionen syslog() i Glibc er ikke beregnet til brug i asynkront udf\u00f8rte signalhandler, da den kalder funktioner som malloc() og free(). Udl\u00f8sningen af SIGALRM-signalet, der underbryder udf\u00f8relsen af specifik kode i sshd, kan f\u00f8re til en tilstandsun\u00f8jagtighed, og opgaven for exploitation er at skabe forhold, der muligg\u00f8r underbrydelsen af den n\u00f8dvendige kode p\u00e5 det rette tidspunkt af dens udf\u00f8relse. S\u00e5rbarheden p\u00e5virker ikke OpenBSD, da der i stedet for syslog() kaldes funktionen syslog_r() fra SIGALRM-signalen, som er specielt designet til asynkron k\u00f8rsel. \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Qualys \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-6387) \u0432 OpenSSH, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root \u0431\u0435\u0437 \u043f\u0440\u043e\u0445\u043e\u0436\u0434\u0435\u043d\u0438\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f regreSSHion, \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u0435\u0440\u0441\u0438\u0438 OpenSSH 8.5 \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0441\u043e \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u043e\u0439 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u043e\u0439 Glibc. \u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u043d\u0430 32-\u0440\u0430\u0437\u0440\u044f\u0434\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0441 Glibc \u0441 \u0432\u043a\u043b\u044e\u0447\u0451\u043d\u043d\u043e\u0439 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 ASLR (\u0440\u0430\u043d\u0434\u043e\u043c\u0438\u0437\u0430\u0446\u0438\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-116883","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47S\u00e5rbarhed i OpenSSH, der muligg\u00f8r fjernudf\u00f8relse af kode med root-rettigheder p\u00e5 servere med Glibc | ProHoster","description":"Qualys har identificeret en kritisk s\u00e5rbarhed (CVE-2024-6387) i OpenSSH, der muligg\u00f8r fjernudf\u00f8relse af kode med root-rettigheder uden at skulle gennemg\u00e5 autentificering.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/uyazvimost-v-openssh-pozvolyayushhaya-udalyonno-vypolnit-kod-s-pravami-root-na-serverah-s-glibc","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 OpenSSH, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 \u0441 Glibc | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Qualys \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-6387) \u0432 OpenSSH, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root \u0431\u0435\u0437 \u043f\u0440\u043e\u0445\u043e\u0436\u0434\u0435\u043d\u0438\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438.","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/uyazvimost-v-openssh-pozvolyayushhaya-udalyonno-vypolnit-kod-s-pravami-root-na-serverah-s-glibc","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-07-01T16:05:44+00:00","article:modified_time":"2024-07-01T16:05:44+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"116883","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 21:59:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 03:18:19","updated":"2026-02-09 21:59:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/116883","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=116883"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/116883\/revisions"}],"predecessor-version":[{"id":160364,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/116883\/revisions\/160364"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=116883"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=116883"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=116883"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\nEt af tegnene p\u00e5 fors\u00f8g p\u00e5 angreb er fremkomsten af et stort antal poster i loggen \u00abTimeout before authentication\u00bb.<\/p>\n
\nUnder udviklingen af OpenSSH 8.5 blev blokken \u00ab#ifdef DO_LOG_SAFE_IN_SIGHAND\u00bb ved en fejl fjernet fra funktionen sigdie(), som kaldes direkte fra SIGALRM-handleren.<\/p>\n
\n
Kilde: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"