{"id":119374,"date":"2024-08-12T09:43:01","date_gmt":"2024-08-12T07:43:01","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-postavlyaemom-vo-freebsd-variante-openssh-dopuskayushhaya-udalyonnoe-vypolnenie-koda"},"modified":"2024-08-12T09:43:01","modified_gmt":"2024-08-12T07:43:01","slug":"uyazvimost-v-postavlyaemom-vo-freebsd-variante-openssh-dopuskayushhaya-udalyonnoe-vypolnenie-koda","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimost-v-postavlyaemom-vo-freebsd-variante-openssh-dopuskayushhaya-udalyonnoe-vypolnenie-koda","title":{"rendered":"Vulnerability in the FreeBSD version of OpenSSH allows for remote code execution.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A vulnerability has been identified in the OpenSSH server included with FreeBSD (CVE-2024-7589), allowing for remote code execution with root privileges without authentication. This vulnerability is a variant of the issue found earlier in July in OpenSSH (CVE-2024-6387) and is also caused by a race condition arising from executing functions in signal handlers that are not designed to be called asynchronously. <\/p>\n
The FreeBSD developers addressed the original July vulnerability immediately after it was announced, but the fix did not cover all potential attack vectors. The fix involved disabling the sshlogv function call, which allocates memory dynamically. This could lead to corruption of malloc's internal structures during asynchronous execution when the SIGALRM signal handler was triggered while certain code was running. It turned out that a similar problem arose in the FreeBSD-specific invocation of the blacklist_notify function, which integrates with the background process blacklistd. <\/p>\n
In addition to applying the patch, the vulnerability can be blocked by setting the parameter «LoginGraceTime=0» in \/etc\/ssh\/sshd_config, but disabling the timeout will facilitate denial-of-service initiation when establishing a large number of connections that exceed the limits set by the MaxStartups parameter. <\/p>\n
In addition, three more vulnerabilities have been fixed in FreeBSD: <\/p>\n
\n
CVE-2024-6760 \u2014 a vulnerability that allows bypassing protection against using ktrace for tracing suid processes, enabling an unprivileged user to access the contents of files that they do not have permission to read, such as being able to read the contents of files with user password hashes.\n
CVE-2024-6759 \u2014 a vulnerability found in the NFS client that allows the use of path separator characters «..» and «\\\/» in file names;\n
CVE-2024-6640 \u2014 a vulnerability in the PF packet filter, which caused ICMPv6 packets with a zero identifier to bypass the firewall rules designed for incoming packets that are reflected in the state table. <\/ul>\n