{"id":115101,"date":"2024-04-16T14:30:16","date_gmt":"2024-04-16T12:30:16","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-putty-pozvolyayushhaya-vosstanovit-zakrytyj-klyuch-polzovatelya"},"modified":"2024-04-16T14:30:16","modified_gmt":"2024-04-16T12:30:16","slug":"uyazvimost-v-putty-pozvolyayushhaya-vosstanovit-zakrytyj-klyuch-polzovatelya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-putty-pozvolyayushhaya-vosstanovit-zakrytyj-klyuch-polzovatelya","title":{"rendered":"PuTTY haavatavus, mis v\u00f5imaldab taastada kasutaja privaatv\u00f5tit","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

PuTTY, Windowsi platvormal populaarne SSH-protokolli klient, on tuvastatud ohtlik haavatavus (CVE-2024-31497), mis v\u00f5imaldab taastada kasutaja privaatv\u00f5tme, mis on loodud NIST P-521 elliptse k\u00f5vera ECDSA algoritmi abil (ecdsa-sha2-nistp521). Privaatv\u00f5tme leidmiseks piisab umbes 60 digitaalallkiri anal\u00fc\u00fcsimisest, mille on loonud probleemne v\u00f5ti. <\/p>\n

Haavatavus ilmneb alates PuTTY versioonist 0.68 ning see m\u00f5jutas ka tooteid, mis sisaldavad haavatavaid versioone PuTTY-st, n\u00e4iteks FileZilla (3.24.1 \u2014 3.66.5), WinSCP (5.9.5 \u2014 6.3.2), TortoiseGit (2.4.0.2 \u2014 2.15.0) ja TortoiseSVN (1.10.0 \u2014 1.14.6). Probleem on lahendatud PuTTY versioonis 0.81, FileZilla versioonis 3.67.0, WinSCP versioonis 6.3.3 ja TortoiseGit versioonis 2.15.0.1. P\u00e4rast v\u00e4rskenduse installimist soovitatakse kasutajatel genereerida uued v\u00f5tmed ja eemaldada vanad avalikud v\u00f5tmed failidest authorized_keys. <\/p>\n

Haavatavus on tingitud arendajate hooletusest, kes kasutasid 521-bitise v\u00f5tme genereerimiseks 512-bitise juhusliku arvu p\u00f5hjal init-vektorit (nonce), arvestades, et 512-bitine entropia oleks piisav ning j\u00e4\u00e4nud 9 bitti ei oma olulist t\u00e4hendust. Tulemusena olid k\u00f5ik PuTTY-s loodud ecdsa-sha2-nistp521 algoritmi abil loodud privaatv\u00f5tmetes esimesed 9 bitti init-vektorist alati nulliga. <\/p>\n

ECDSA ja DSA puhul on oluline juhuslike arvude generaatori kvaliteet ja parameetri, mida kasutatakse mooduli arvutamisel, t\u00e4ielik katmine juhuslike andmetega, kuna isegi m\u00f5ne bitise informatsiooni m\u00e4\u00e4ramine init-vektori kohta on piisav, et teostada r\u00fcnnak, et j\u00e4rjestikku taastada kogu privaatv\u00f5ti. V\u00f5tme eduka taastamise jaoks piisab avaliku v\u00f5tme olemasolust ja mitme k\u00fcmne digitaalallkirja anal\u00fc\u00fcsimisest, mille on loonud probleemne v\u00f5ti r\u00fcnnakule tuntud andmete jaoks. R\u00fcnnak tugineb HNP (Hidden Number Problem) probleemi lahendamisele. <\/p>\n

Vajalikud digiallkirjad on saadaval n\u00e4iteks siis, kui kasutaja on \u00fchendatud r\u00fcndaja SSH-serveriga v\u00f5i Git-serveriga, mis kasutab SSH-d transpordina. R\u00fcnnakuks vajalikud allkirjad on samuti saadaval, kui v\u00f5ti on kasutatud juhuslike andmete, n\u00e4iteks git-commitide allkirjastamiseks, kasutades SSH-agent Pageant'i, et suunata liiklust arendaja hosti. MITM-r\u00fcnnaku k\u00e4igus on vajalikud andmed v\u00f5tme taastamiseks k\u00e4ttesaamatud, kuna SSH-s allkirju ei edastata avatud kujul. <\/p>\n

T\u00e4heldatakse, et sarnast osalise algusvektorite kasutust on rakendatud PuTTY-s ja teiste elliptiliste k\u00e4\u00e4ride t\u00fc\u00fcpides, kuid ECDSA P-521-st erinevate algoritmide puhul ei ole teabe lekkeid piisavalt, et teostada t\u00f6\u00f6tavat r\u00fcnnakut v\u00f5tme taastamiseks. Teise suurusega ECDSA v\u00f5tmed ja Ed25519 v\u00f5tmed ei ole r\u00fcnnaku all.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 PuTTY, \u043a\u043b\u0438\u0435\u043d\u0442\u0435 \u0434\u043b\u044f \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 SSH, \u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0435\u0433\u043e\u0441\u044f \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u0441\u0442\u044c\u044e \u043d\u0430 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 Windows, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043e\u043f\u0430\u0441\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-31497), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u043e\u0441\u0441\u043e\u0437\u0434\u0430\u0442\u044c \u0437\u0430\u043a\u0440\u044b\u0442\u044b\u0439 \u043a\u043b\u044e\u0447 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0441\u0433\u0435\u043d\u0435\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0430\u043b\u0433\u043e\u0440\u0438\u0442\u043c\u0430 ECDSA \u0441 \u044d\u043b\u043b\u0438\u043f\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043a\u0440\u0438\u0432\u043e\u0439 NIST P-521 (ecdsa-sha2-nistp521). \u0414\u043b\u044f \u043f\u043e\u0434\u0431\u043e\u0440\u0430 \u0437\u0430\u043a\u0440\u044b\u0442\u043e\u0433\u043e \u043a\u043b\u044e\u0447\u0430 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043f\u0440\u043e\u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e 60 \u0446\u0438\u0444\u0440\u043e\u0432\u044b\u0445 \u043f\u043e\u0434\u043f\u0438\u0441\u0435\u0439, \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u043d\u044b\u043c \u043a\u043b\u044e\u0447\u043e\u043c. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u0435\u0440\u0441\u0438\u0438 PuTTY 0.68 \u0438 \u0442\u0430\u043a\u0436\u0435 \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u043b\u0430 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u044b, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-115101","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47PuTTY haavatavus, mis v\u00f5imaldab taastada kasutaja salajase v\u00f5tme | ProHoster","description":"PuTTY-s, SSH-protokolli kliendis, mis on populaarne Windowsi platvormil, on avastatud ohtlik haavatavus (CVE-2024-31497), mis v\u00f5imaldab taastada kasutaja salajase v\u00f5tme, mis on genereeritud kasutades.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-putty-pozvolyayushhaya-vosstanovit-zakrytyj-klyuch-polzovatelya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 PuTTY, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u043e\u0441\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u0437\u0430\u043a\u0440\u044b\u0442\u044b\u0439 \u043a\u043b\u044e\u0447 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f | ProHoster","og:description":"\u0412 PuTTY, \u043a\u043b\u0438\u0435\u043d\u0442\u0435 \u0434\u043b\u044f \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 SSH, \u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0435\u0433\u043e\u0441\u044f \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u0441\u0442\u044c\u044e \u043d\u0430 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 Windows, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043e\u043f\u0430\u0441\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-31497), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u043e\u0441\u0441\u043e\u0437\u0434\u0430\u0442\u044c \u0437\u0430\u043a\u0440\u044b\u0442\u044b\u0439 \u043a\u043b\u044e\u0447 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0441\u0433\u0435\u043d\u0435\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-putty-pozvolyayushhaya-vosstanovit-zakrytyj-klyuch-polzovatelya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-04-16T12:30:16+00:00","article:modified_time":"2024-04-16T12:30:16+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"115101","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 22:28:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-22 22:28:19","updated":"2026-01-22 22:28:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/115101","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=115101"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/115101\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=115101"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=115101"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=115101"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}