{"id":101551,"date":"2021-10-06T04:22:36","date_gmt":"2021-10-06T02:22:36","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-http-servere-apache-2-4-49-pozvolyayushhaya-poluchit-fajly-vne-kornya-sajta"},"modified":"2021-10-06T04:22:36","modified_gmt":"2021-10-06T02:22:36","slug":"uyazvimost-v-http-servere-apache-2-4-49-pozvolyayushhaya-poluchit-fajly-vne-kornya-sajta","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimost-v-http-servere-apache-2-4-49-pozvolyayushhaya-poluchit-fajly-vne-kornya-sajta","title":{"rendered":"Haavatavus Apache 2.4.49 HTTP serveris v\u00f5imaldab faili saada v\u00e4ljaspool saidi juurt","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

T\u00e4iendav v\u00e4rskendus Apache http-serveri versioonile 2.4.50 on v\u00e4lja antud, et k\u00f5rvaldada aktiivselt kasutuses olnud 0-p\u00e4eva haavatavus (CVE-2021-41773), mis v\u00f5imaldab p\u00e4\u00e4seda juurde failidele veebisaidi juurkatalooge \u00fcmbritsevatest piirkondadest. Antud haavatavuse t\u00f5ttu on v\u00f5imalik laadida s\u00fcsteemifaile ja veebiskeemide l\u00e4htekoodifailid, millele on juurdep\u00e4\u00e4s kasutajal, kes k\u00e4itab http-serverit. Arendajaid teavitati probleemist juba 17. septembril, kuid nad suutsid v\u00e4rskenduse v\u00e4lja anda alles t\u00e4na, p\u00e4rast seda, kui veebis avastati haavatavuse kasutamise juhtumeid r\u00fcnnakute jaoks veebisaitidele. <\/p>\n

Haavatavuse oht on leevendatud, kuna probleem esineb ainult hiljuti v\u00e4lja antud versioonis 2.4.49 ning ei m\u00f5juta k\u00f5iki varasemaid versioone. Stabiilsetes harudes, nagu Debian, RHEL, Ubuntu ja SUSE, pole 2.4.49 versiooni veel kasutatud, kuid probleem on puudutanud pidevalt v\u00e4rskendatavaid jaotusi nagu Fedora, Arch Linux ja Gentoo ning ka FreeBSD porte. <\/p>\n

Haavatavus on p\u00f5hjustatud veast, mis tehti koodi \u00fcmbertegemisel URI teede normaliseerimise jaoks, mille t\u00f5ttu ei normaliseeritud tee punktis\u00fcmbolit, mis on kodeeritud kasutades sekventsi '', kui selle ette tuli teine punkt. Seega oli v\u00f5imalik sisestada puhastamata s\u00fcmboleid '..\/' tulemuslikku teed, kui p\u00e4ringus kasutati sekventsi '.\/'. N\u00e4iteks p\u00e4ring nagu 'https:\/\/example.com\/cgi-bin\/.\/.\/.\/.\/etc\/passwd' v\u00f5i 'https:\/\/example.com\/cgi-bin\/.\/\/\/\/etc\/hosts' v\u00f5imaldas saada faili sisu '\/etc\/passwd'. <\/p>\n

Probleem ei ilmne, kui juurdep\u00e4\u00e4s kataloogidele on selgelt keelatud seadistusega 'require all denied'. N\u00e4iteks osalise kaitse jaoks v\u00f5ib konfiguratsioonifailis m\u00e4\u00e4rata: \n require all denied <\/p>\n

Apache httpd 2.4.50 versioonis on samuti k\u00f5rvaldatud veel \u00fcks haavatavus (CVE-2021-41524), mis m\u00f5jutab HTTP\/2 protokolli rakendavat moodulit. See haavatavus v\u00f5imaldas erikujulise p\u00e4ringu saatmise kaudu algatada nulli de-referentsimise ja p\u00f5hjustada protsessi kokkujooksu. See haavatavus ilmneb vaid versioonis 2.4.49. Kaitseks on v\u00f5imalik keelata HTTP\/2 toe kasutamine.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u044d\u043a\u0441\u0442\u0440\u0435\u043d\u043d\u043e\u043c \u043f\u043e\u0440\u044f\u0434\u043a\u0435 \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 http-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.50, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u0436\u0435 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u0430\u044f 0-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-41773), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0444\u0430\u0439\u043b\u0430\u043c \u0438\u0437 \u043e\u0431\u043b\u0430\u0441\u0442\u0435\u0439 \u0432\u043d\u0435 \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0433\u043e \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430 \u0441\u0430\u0439\u0442\u0430. \u041f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u0438 \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u0435 \u0442\u0435\u043a\u0441\u0442\u044b web-\u0441\u043a\u0440\u0438\u043f\u0442\u043e\u0432, \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0435 \u0434\u043b\u044f \u0447\u0442\u0435\u043d\u0438\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e, \u043f\u043e\u0434 \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u0437\u0430\u043f\u0443\u0449\u0435\u043d http-\u0441\u0435\u0440\u0432\u0435\u0440. \u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0431\u044b\u043b\u0438 \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u044b \u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0435 \u0435\u0449\u0451 17 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-101551","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Haavatavus http-serveris Apache 2.4.49, mis v\u00f5imaldab p\u00e4\u00e4seda failidele v\u00e4ljaspool saidi juurt | ProHoster","description":"H\u00e4daolukorras on loodud uuendus http-serverile Apache 2.4.50, milles on k\u00f5rvaldatud juba aktiivselt ekspluateeritav 0-day haavatavus (CVE-2021-41773), mis v\u00f5imaldab juurdep\u00e4\u00e4su failidele turbiidi (root) kataloogist v\u00e4ljaspool. Haavatavuse abil saab \u00fcles laadida suvalised s\u00fcsteemifailid ja veebiskriptide l\u00e4htekoodid, mis on sellel kasutajale, kes k\u00e4itab http-serverit, lugemis\u00f5igusega. Arendajad said probleemist teate juba 17.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimost-v-http-servere-apache-2-4-49-pozvolyayushhaya-poluchit-fajly-vne-kornya-sajta","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 http-\u0441\u0435\u0440\u0432\u0435\u0440\u0435 Apache 2.4.49, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0444\u0430\u0439\u043b\u044b \u0432\u043d\u0435 \u043a\u043e\u0440\u043d\u044f \u0441\u0430\u0439\u0442\u0430 | ProHoster","og:description":"\u0412 \u044d\u043a\u0441\u0442\u0440\u0435\u043d\u043d\u043e\u043c \u043f\u043e\u0440\u044f\u0434\u043a\u0435 \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 http-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.50, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u0436\u0435 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u0430\u044f 0-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-41773), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0444\u0430\u0439\u043b\u0430\u043c \u0438\u0437 \u043e\u0431\u043b\u0430\u0441\u0442\u0435\u0439 \u0432\u043d\u0435 \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0433\u043e \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430 \u0441\u0430\u0439\u0442\u0430. \u041f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u0438 \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u0435 \u0442\u0435\u043a\u0441\u0442\u044b web-\u0441\u043a\u0440\u0438\u043f\u0442\u043e\u0432, \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0435 \u0434\u043b\u044f \u0447\u0442\u0435\u043d\u0438\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e, \u043f\u043e\u0434 \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u0437\u0430\u043f\u0443\u0449\u0435\u043d http-\u0441\u0435\u0440\u0432\u0435\u0440. \u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0431\u044b\u043b\u0438 \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u044b \u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0435 \u0435\u0449\u0451 17","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimost-v-http-servere-apache-2-4-49-pozvolyayushhaya-poluchit-fajly-vne-kornya-sajta","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-10-06T02:22:36+00:00","article:modified_time":"2021-10-06T02:22:36+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"101551","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-10-06 02:24:19","updated":"2022-09-29 22:14:23"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/101551","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=101551"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/101551\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=101551"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=101551"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=101551"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}