{"id":116883,"date":"2024-07-01T18:05:44","date_gmt":"2024-07-01T16:05:44","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-openssh-pozvolyayushhaya-udalyonno-vypolnit-kod-s-pravami-root-na-serverah-s-glibc"},"modified":"2024-07-01T18:05:44","modified_gmt":"2024-07-01T16:05:44","slug":"uyazvimost-v-openssh-pozvolyayushhaya-udalyonno-vypolnit-kod-s-pravami-root-na-serverah-s-glibc","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimost-v-openssh-pozvolyayushhaya-udalyonno-vypolnit-kod-s-pravami-root-na-serverah-s-glibc","title":{"rendered":"Haavatavus OpenSSH-s, mis v\u00f5imaldab kaugteostust \u00f5igustega root serverites, kus on Glibc","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Qualys avastas kriitilise haavatavuse (CVE-2024-6387) OpenSSH-s, mis v\u00f5imaldab kaugete koodide t\u00e4itmist root \u00f5igustes ilma autentimiseta. Haavatavus, mida kutsutakse regreSSHion, esineb vaikimisi konfiguratsioonis alates OpenSSH versioonist 8.5 s\u00fcsteemides, kus on kasutusel tavaline Glibc teek. <\/p>\n

R\u00fcnnaku v\u00f5imalust demonstreeriti 32-bitises s\u00fcsteemis Glibc-ga, kus ASLR (aadressiruumi randomiseerimine) kaitse on sisse l\u00fclitatud. Laboratoorsetes tingimustes n\u00f5udis edukas r\u00fcnnak 6-8 tundi, mille jooksul loodi pidevalt \u00fchendusi maximalse sshd konfiguratsioonis lubatud intensiivsusega. R\u00fcnnaku teostamine on lihtsam ja n\u00f5uab v\u00e4hem aega s\u00fcsteemides, kus ASLR ei ole olemas v\u00f5i jaotustes, mis kasutavad muudetud OpenSSH-d, kus on keelatud ASLR-i korduv randomiseerimine igaks \u00fchenduseks. T\u00f6\u00f6tavat protot\u00fc\u00fcpi eksploiti ei kavatseta enne haavatavuse laialdast k\u00f5rvaldamist avaldada, kuid piisavalt \u00fcksikasjalik kirjeldus haavatavuse olemusest on saadaval, mis muudab kolmandate isikute eksplootide ilmumise ajak\u00fcsimuseks. serveriga<\/a> R\u00fcnnakute v\u00f5imalusi ei saa v\u00e4listada ka 64-bitistes s\u00fcsteemides, kuid t\u00f6\u00f6tav eksploit nende jaoks pole veel valmis. Eeldatakse, et r\u00fcnnaku l\u00e4biviimine 64-bitistes s\u00fcsteemides v\u00f5tab palju rohkem aega, kuid mitte \u00fcle n\u00e4dala. OpenSSH on OpenBSD-s probleemist immuunne, kuna selles s\u00fcsteemis on alates 2001. aastast kasutusel kaitsemehhanism, mis blokeerib taolised r\u00fcnnakud. Teistes s\u00fcsteemides, mis p\u00f5hinevad standardsetel teekidel, mis ei ole Glibc, on teoreetiliselt v\u00f5imalik meetodit r\u00fcnnaku jaoks kohandada (Qualyses seda k\u00fcsimust hetkel ei uurita).<\/p>\n

64-bit s\u00fcsteemide vastu r\u00fcnnaku t\u00f5en\u00e4osus ei ole v\u00e4listatud, kuid t\u00f6\u00f6tav eksploiteerimisversioon sellistele s\u00fcsteemidele pole veel valmis. Eeldatakse, et 64-bitistele s\u00fcsteemidele r\u00fcnnaku korraldamine v\u00f5tab palju rohkem aega, kuid mitte kauem kui n\u00e4dal. OpenSSH OpenBSD-s ei ole sellele probleemile vastuv\u00f5tlik, kuna alates 2001. aastast rakendatakse selles s\u00fcsteemis kaitsemehhanismi, mis blokeerib selliseid r\u00fcnnakute kategooriaid. Teistes s\u00fcsteemides, mis p\u00f5hinevad standardsetel teekidel, mis erinevad Glibc-st, on r\u00fcnnaku meetodi kohandamine teoreetiliselt v\u00f5imalik (seda k\u00fcsimust pole Qualyses veel uuritud). <\/p>\n

Haavatavus on k\u00f5rvaldatud t\u00e4na avaldatud OpenSSH 9.8 (patch) versioonis. Pakettide uuenduste avaldamise j\u00e4lgimine jaotustes on v\u00f5imalik lehtedel: Debian, Ubuntu, RHEL, SUSE\/openSUSE, Fedora, ROSA, Gentoo, ALT Linux, Arch ja FreeBSD. Haavatavuse blokeerimise ajutise lahendusena saab sshd_config'is seadistada parameetri \u00abLoginGraceTime=0\u00bb, kuid ajutise taimeri eemaldamine h\u00f5lbustab teenuse osutamise keeldumise algatamist, kui on loodud suur hulk \u00fchendusi, mis \u00fcletavad parameetriga MaxStartups m\u00e4\u00e4ratud piirangud.
\n\u00dcks r\u00fcnnakute katsetamise m\u00e4rke on suur hulk logikirjeid \u00abTimeout before authentication\u00bb.<\/p>\n

Haavatavus tekkis regressiivse muudatuse t\u00f5ttu, mis sai osa OpenSSH 8.5 versioonist ja p\u00f5hjustas v\u00f5istluse oleku signalide t\u00f6\u00f6tlemise koodis sshd-s. Regresioon viis vana haavatavuse CVE-2006-5051 kaitse l\u00f5petamiseni, mis esines enne OpenSSH 4.4 (2006. aastal) ja oli teoreetiline.
\nOpenSSH 8.5 arendamise k\u00e4igus eemaldati ekslikult funktsioonist sigdie(), mis kutsutakse otse SIGALRM k\u00e4sitlejast, plokk \u00ab#ifdef DO_LOG_SAFE_IN_SIGHAND\u00bb.<\/p>\n

SIGALRM k\u00e4itleja kutsub sshd-s as\u00fcnkr \u0645\u0648delin, kui klient ei ole autentimist teinud selle ajakava piiratud ajas (LoginGraceTime, vaikev\u00e4\u00e4rtus 120 sek). R\u00fcnnak p\u00f5hineb asjaolul, et signaali k\u00e4itleja kutsub \u00fcles mitte turvalisi funktsioone as\u00fcnkr moodeli signaalide t\u00f6\u00f6tlemise ajal, nagu syslog(). Funktsioon syslog() Glibc-s ei ole m\u00f5eldud kasutamiseks as\u00fcnkroonsete signaali t\u00f6\u00f6tlejatena, kuna kutsub \u00fcles funktsioone malloc() ja free(). SIGALRM signaali v\u00e4ljakutsumine, mis katkestab teatava koodi t\u00f6\u00f6 sshd-s, v\u00f5ib viia t\u00e4itmisoleku rikkumiseni, ja eksploiti \u00fclesanne on luua tingimused vajaliku koodi katkestamiseks vajaliku aja jooksul. OpenBSD-d ei m\u00f5jutata, kuna selles kutsutakse SIGALRM signaalihandlers out syslog() asemel funktsioon kurt, mis on loodud as\u00fcnkroonseks kasutamiseks.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Qualys \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-6387) \u0432 OpenSSH, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root \u0431\u0435\u0437 \u043f\u0440\u043e\u0445\u043e\u0436\u0434\u0435\u043d\u0438\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f regreSSHion, \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u0435\u0440\u0441\u0438\u0438 OpenSSH 8.5 \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0441\u043e \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u043e\u0439 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u043e\u0439 Glibc. \u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u043d\u0430 32-\u0440\u0430\u0437\u0440\u044f\u0434\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0441 Glibc \u0441 \u0432\u043a\u043b\u044e\u0447\u0451\u043d\u043d\u043e\u0439 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 ASLR (\u0440\u0430\u043d\u0434\u043e\u043c\u0438\u0437\u0430\u0446\u0438\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-116883","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Avastus OpenSSH haavatavusest, mis v\u00f5imaldab kaugel root-koodiga k\u00e4itada Glibc serverites | ProHoster","description":"Qualys avastas kriitilise turvaviga (CVE-2024-6387) OpenSSH-s, mis v\u00f5imaldab kaugk\u00e4ivitada koodi root-i \u00f5igustes ilma autentimiseta. Turvaviga, mis on saanud koodinimeks regreSSHion, ilmneb vaikimisi konfiguratsioonis alates OpenSSH versioonist 8.5 s\u00fcsteemides, kus on standardne Glibc raamatukogu. R\u00fcnnaku v\u00f5imalus demonstreeriti 32-bitises s\u00fcsteemis Glibc-ga, kus on aktiivne ASLR kaitse (juhuslikkus).","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimost-v-openssh-pozvolyayushhaya-udalyonno-vypolnit-kod-s-pravami-root-na-serverah-s-glibc","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 OpenSSH, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 \u0441 Glibc | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Qualys \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-6387) \u0432 OpenSSH, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root \u0431\u0435\u0437 \u043f\u0440\u043e\u0445\u043e\u0436\u0434\u0435\u043d\u0438\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f regreSSHion, \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u0435\u0440\u0441\u0438\u0438 OpenSSH 8.5 \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0441\u043e \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u043e\u0439 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u043e\u0439 Glibc. \u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u043d\u0430 32-\u0440\u0430\u0437\u0440\u044f\u0434\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0441 Glibc \u0441 \u0432\u043a\u043b\u044e\u0447\u0451\u043d\u043d\u043e\u0439 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 ASLR (\u0440\u0430\u043d\u0434\u043e\u043c\u0438\u0437\u0430\u0446\u0438\u044f","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimost-v-openssh-pozvolyayushhaya-udalyonno-vypolnit-kod-s-pravami-root-na-serverah-s-glibc","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-07-01T16:05:44+00:00","article:modified_time":"2024-07-01T16:05:44+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"116883","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 21:59:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 03:18:19","updated":"2026-02-09 21:59:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/116883","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=116883"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/116883\/revisions"}],"predecessor-version":[{"id":160364,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/116883\/revisions\/160364"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=116883"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=116883"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=116883"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}