{"id":101551,"date":"2021-10-06T04:22:36","date_gmt":"2021-10-06T02:22:36","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-http-servere-apache-2-4-49-pozvolyayushhaya-poluchit-fajly-vne-kornya-sajta"},"modified":"2021-10-06T04:22:36","modified_gmt":"2021-10-06T02:22:36","slug":"uyazvimost-v-http-servere-apache-2-4-49-pozvolyayushhaya-poluchit-fajly-vne-kornya-sajta","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-http-servere-apache-2-4-49-pozvolyayushhaya-poluchit-fajly-vne-kornya-sajta","title":{"rendered":"Haavatavus Apache 2.4.49 http-serveris, mis v\u00f5imaldab ligip\u00e4\u00e4su failidele veebiregistri juurest v\u00e4ljaspool","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Kiires korras on v\u00e4lja antud Apache 2.4.50 veebiserveri uuendus, mis k\u00f5rvaldab aktiivselt kuritarvitatava 0-p\u00e4eva haavatavuse (CVE-2021-41773), mis v\u00f5imaldab juurdep\u00e4\u00e4su failidele, mis asuvad v\u00e4ljaspool veebisaidi juurkatalooge. Selle haavatavuse abil on v\u00f5imalik laadida juhuslikke s\u00fcsteemifaile ja veebiskripti allikaid, millele on juurdep\u00e4\u00e4s lugemiseks kasutajal, kelle all veebiserver t\u00f6\u00f6tab. Arendajaid teavitati probleemist juba 17. septembril, kuid nad suutsid uuenduse v\u00e4lja anda alles t\u00e4na, p\u00e4rast seda, kui internetis on registreeritud juhtumeid haavatavuse kasutamisest r\u00fcnnakutes veebisaitide vastu. <\/p>\n

Haavatavuse oht on leevendatud, kuna probleem ilmneb ainult hiljuti v\u00e4ljastatud 2.4.49 versioonis ja see ei m\u00f5juta varasemaid versioone. Konservatiivsete serveridistroode stabiilsetes harudes ei ole 2.4.49 veel kasutusele v\u00f5etud (Debian, RHEL, Ubuntu, SUSE), kuid probleem on m\u00f5jutanud pidevalt uuendatavaid distroosid, nagu Fedora, Arch Linux ja Gentoo, samuti FreeBSD porti. <\/p>\n

Haavatavus tuleneb \u00fclesande k\u00e4igus tehtud koodimuudatusest URI-de tee normaliseerimiseks, mille t\u00f5ttu ei normaliseeritud teed punkt, mis oli kodeeritud j\u00e4rjestusega '', kui eelnevalt oli teine punkt. Nii oli v\u00f5imalik sisestada infektsioone '.. \/' tulemuseks teele, kasutades p\u00e4ringus j\u00e4rjestust '. \/'. N\u00e4iteks p\u00e4ring nagu 'https:\/\/example.com\/cgi-bin\/.\/.\/.\/.\/etc\/passwd' v\u00f5i 'https:\/\/example.com\/cgi-bin\/.\/\/\/\/etc\/hosts' v\u00f5imaldas p\u00e4\u00e4seda failide ' \/etc\/passwd ' sisule. <\/p>\n

Probleem ei ilmne, kui juurdep\u00e4\u00e4s kataloogidele on selgelt keelatud seadistusega 'require all denied'. N\u00e4iteks osalise kaitse tagamiseks v\u00f5ite konfigureerimisfailis n\u00e4idata: require all denied <\/p>\n

Apache httpd 2.4.50 versioonis on samuti k\u00f5rvaldatud veel \u00fcks haavatavus (CVE-2021-41524), mis puudutab HTTP\\\/2 protokolli rakendust. Haavatavus v\u00f5imaldas spetsiaalselt vormindatud p\u00e4ringu saatmise kaudu algatada nullviidiku de-referentseerimise ja protsessi krahhi. See haavatavus ilmneb samuti ainult versioonis 2.4.49. Kaitse alternatiivina v\u00f5ib v\u00e4lja l\u00fclitada HTTP\\\/2 protokolli toe.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u044d\u043a\u0441\u0442\u0440\u0435\u043d\u043d\u043e\u043c \u043f\u043e\u0440\u044f\u0434\u043a\u0435 \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 http-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.50, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u0436\u0435 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u0430\u044f 0-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-41773), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0444\u0430\u0439\u043b\u0430\u043c \u0438\u0437 \u043e\u0431\u043b\u0430\u0441\u0442\u0435\u0439 \u0432\u043d\u0435 \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0433\u043e \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430 \u0441\u0430\u0439\u0442\u0430. \u041f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u0438 \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u0435 \u0442\u0435\u043a\u0441\u0442\u044b web-\u0441\u043a\u0440\u0438\u043f\u0442\u043e\u0432, \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0435 \u0434\u043b\u044f \u0447\u0442\u0435\u043d\u0438\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e, \u043f\u043e\u0434 \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u0437\u0430\u043f\u0443\u0449\u0435\u043d http-\u0441\u0435\u0440\u0432\u0435\u0440. \u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0431\u044b\u043b\u0438 \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u044b \u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0435 \u0435\u0449\u0451 17 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-101551","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Haavatavus http-serveris Apache 2.4.49, mis v\u00f5imaldab ligip\u00e4\u00e4su failidele saidi juurest v\u00e4ljaspool | ProHoster","description":"Kiireloomulisel korras on v\u00e4lja antud uuendus http-serverile Apache 2.4.50, milles on k\u00f5rvaldatud juba aktiivselt kasutusel olnud 0-p\u00e4ev haavatavus (CVE-2021-41773), mis v\u00f5imaldab ligip\u00e4\u00e4su failidele saidi juurest v\u00e4ljaspool.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-http-servere-apache-2-4-49-pozvolyayushhaya-poluchit-fajly-vne-kornya-sajta","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 http-\u0441\u0435\u0440\u0432\u0435\u0440\u0435 Apache 2.4.49, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0444\u0430\u0439\u043b\u044b \u0432\u043d\u0435 \u043a\u043e\u0440\u043d\u044f \u0441\u0430\u0439\u0442\u0430 | ProHoster","og:description":"\u0412 \u044d\u043a\u0441\u0442\u0440\u0435\u043d\u043d\u043e\u043c \u043f\u043e\u0440\u044f\u0434\u043a\u0435 \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 http-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.50, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u0436\u0435 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u0430\u044f 0-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-41773), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0444\u0430\u0439\u043b\u0430\u043c \u0438\u0437 \u043e\u0431\u043b\u0430\u0441\u0442\u0435\u0439 \u0432\u043d\u0435.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-http-servere-apache-2-4-49-pozvolyayushhaya-poluchit-fajly-vne-kornya-sajta","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-10-06T02:22:36+00:00","article:modified_time":"2021-10-06T02:22:36+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"101551","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-10-06 02:24:19","updated":"2022-09-29 22:14:23","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/101551","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=101551"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/101551\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=101551"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=101551"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=101551"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}