Qualys avastas kriitilise haavatavuse (CVE-2024-6387) OpenSSH-s, mis v\u00f5imaldab kaugk\u00e4ivitamist root-kasutajaga ilma autentimiseta. Haavatavus, mille koodnimi on regreSSHion, avaldub vaikimisi konfiguratsioonis alates OpenSSH 8.5 versioonist s\u00fcsteemides, kus on tavaline Glibci teek. <\/p>\n
R\u00fcnnaku v\u00f5imalust demonstreeriti 32-bitisel s\u00fcsteemil Glibc-ga, kus oli sisse l\u00fclitatud ASLR kaitse (aadressiruumi randomiseerimine). Eduka r\u00fcnnaku teostamiseks laboris oli vajalik 6-8 tundi, mille jooksul loodi pidevalt \u00fchendusi maksimaalse lubatud intensiivsusega sshd konfiguratsioonis. serverilt<\/a> R\u00fcnnaku sooritamine on lihtsam ja n\u00f5uab v\u00e4hem aega s\u00fcsteemides, kus ASLR puudub, v\u00f5i jaotustes, mis kasutavad muudetud OpenSSH-d, kus on keelatud ASLR-i korduv randomiseerimine iga\u00fchenduse jaoks. T\u00f6\u00f6protot\u00fc\u00fcpi eksploitist ei kavatseta avalikult avaldada enne, kui haavatavus on laialdaselt k\u00f5rvaldatud, kuid samas on saadaval piisavalt \u00fcksikasjalik kirjeldus haavatavuse olemusest, mis muudab kolmandate osapoolte eksploitide tekkimise ajak\u00fcsimuseks.<\/p>\n Ei v\u00e4listata r\u00fcnnaku v\u00f5imalust ka 64-bitistes s\u00fcsteemides, kuid sellistele s\u00fcsteemidele ei ole veel t\u00f6\u00f6tavat eksploitit valmis. Eeldatakse, et r\u00fcnnaku tegemine 64-bitistes s\u00fcsteemides v\u00f5tab palju rohkem aega, kuid mitte kauem kui n\u00e4dal. OpenSSH OpenBSD-s ei ole probleemile vastuv\u00f5tlik, kuna selles s\u00fcsteemis on alates 2001. aastast rakendatud kaitsemehhanismi, mis blokeerib sellised r\u00fcnnakud. Teistes s\u00fcsteemides, mis p\u00f5hinevad standardteekidel, mis erinevad Glibc-st, on teoreetiliselt v\u00f5imalik meetodi kohandamine r\u00fcnnaku teostamiseks (Qualyse puhul ei ole seda k\u00fcsimust veel uuritud). <\/p>\n Haavatavus on k\u00f5rvaldatud t\u00e4na avaldatud versioonis OpenSSH 9.8 (patch). Pakettide v\u00e4rskenduste j\u00e4lgimise kohta jaotustes saab tutvuda lehtedel: Debian, Ubuntu, RHEL, SUSE\/openSUSE, Fedora, ROSA, Gentoo, ALT Linux, Arch ja FreeBSD. \u00dcks t\u00f6\u00f6ring on sshd_config-is seadistada parameeter «LoginGraceTime=0», samas kui aja piirangute keelamine lihtsustab teenuse keelamise algatamist, kui seondumiste arv \u00fcletab parameetriga MaxStartups m\u00e4\u00e4ratud piirangud. Haavatavus tekkis regressiivse muudatuse t\u00f5ttu, mis viidi l\u00e4bi OpenSSH 8.5 versioonis ja mis p\u00f5hjustas konkurentsitingimusi signaalide t\u00f6\u00f6tlemise koodis sshd-s. Regressioon l\u00f5petas kaitse vana haavatavuse CVE-2006-5051 eest, mis v\u00e4ljendus kuni OpenSSH 4.4 (2006. aastani) ja millel oli teoreetiline iseloom. SIGALRM t\u00f6\u00f6tlejat kutsutakse sshd-s as\u00fcnkroonselt, kui klient ei ole suutnud autentida end \u00fchenduse katkestamise ajaks (LoginGraceTime, vaikev\u00e4\u00e4rtus 120 sek). R\u00fcnnak p\u00f5hineb sellel, et signaalit\u00f6\u00f6tleja kutsub esile as\u00fcnkroonsel viisil ohtlikke funktsioone, nagu syslog(). Funktsioon syslog() Glibc-s ei ole m\u00f5eldud kasutamiseks as\u00fcnkroonselt t\u00f6\u00f6tlevates signaalit\u00f6\u00f6tlejates, kuna kutsub esile malloc() ja free() funktsioone. SIGALRM signaali aktiveerumine, mis katkestab teatud koodi t\u00e4itmise sshd-s, v\u00f5ib viia t\u00e4itmisoleku rikkumiseni, ning eksploiteerimise eesm\u00e4rk on luua tingimused vajaliku koodi katkestamiseks selle t\u00e4itmise \u00f5igel hetkel. Haavatavus ei m\u00f5juta OpenBSD-d, kuna seal kasutatakse syslog() asemel SIGALRM signaalit\u00f6\u00f6tlejast funktsiooni syslog_r(), mis on spetsiaalselt loodud as\u00fcnkroonselt k\u00e4ivitamiseks. \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Qualys \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-6387) \u0432 OpenSSH, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root \u0431\u0435\u0437 \u043f\u0440\u043e\u0445\u043e\u0436\u0434\u0435\u043d\u0438\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f regreSSHion, \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u0435\u0440\u0441\u0438\u0438 OpenSSH 8.5 \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0441\u043e \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u043e\u0439 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u043e\u0439 Glibc. \u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u043d\u0430 32-\u0440\u0430\u0437\u0440\u044f\u0434\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0441 Glibc \u0441 \u0432\u043a\u043b\u044e\u0447\u0451\u043d\u043d\u043e\u0439 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 ASLR (\u0440\u0430\u043d\u0434\u043e\u043c\u0438\u0437\u0430\u0446\u0438\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-116883","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Haavatavus OpenSSH-s, mis v\u00f5imaldab distantsilt t\u00e4ita koodi root \u00f5igustega Glibc-d kasutavatel serveritel | ProHoster","description":"Ettev\u00f5te Qualys avastas OpenSSH-s kriitilise haavatavuse (CVE-2024-6387), mis v\u00f5imaldab saavutada kaugt\u00e4ide, kasutades root \u00f5igusi, ilma autentimiseta.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-openssh-pozvolyayushhaya-udalyonno-vypolnit-kod-s-pravami-root-na-serverah-s-glibc","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 OpenSSH, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 \u0441 Glibc | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Qualys \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-6387) \u0432 OpenSSH, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root \u0431\u0435\u0437 \u043f\u0440\u043e\u0445\u043e\u0436\u0434\u0435\u043d\u0438\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-openssh-pozvolyayushhaya-udalyonno-vypolnit-kod-s-pravami-root-na-serverah-s-glibc","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-07-01T16:05:44+00:00","article:modified_time":"2024-07-01T16:05:44+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"116883","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 21:59:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 03:18:19","updated":"2026-02-09 21:59:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/116883","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=116883"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/116883\/revisions"}],"predecessor-version":[{"id":160364,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/116883\/revisions\/160364"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=116883"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=116883"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=116883"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n\u00dcks r\u00fcnnakukatsete m\u00e4rke on logis suure arvu «Timeout before authentication» kirjade ilmumine.<\/p>\n
\nOpenSSH 8.5 arendamise k\u00e4igus eemaldati sigdie() funktsioonist, mis kutsutakse otse SIGALRM-i t\u00f6\u00f6tlija kaudu, plokk «#ifdef DO_LOG_SAFE_IN_SIGHAND».<\/p>\n
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"