{"id":123597,"date":"2025-04-18T15:05:07","date_gmt":"2025-04-18T13:05:07","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-ssh-servere-iz-erlang-otp-dopuskayushhaya-udalyonnoe-vypolnenie-koda"},"modified":"2025-04-18T15:05:07","modified_gmt":"2025-04-18T13:05:07","slug":"uyazvimost-v-ssh-servere-iz-erlang-otp-dopuskayushhaya-udalyonnoe-vypolnenie-koda","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-ssh-servere-iz-erlang-otp-dopuskayushhaya-udalyonnoe-vypolnenie-koda","title":{"rendered":"SSH-serveri haavatavus Erlang\/OTP-s, mis v\u00f5imaldab kaugkoodi t\u00e4itmist","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Erlang\/OTP t\u00f6\u00f6riistade komplekti kuuluvasse ssh raamatukokku on avastatud haavatavus (CVE-2025-32433), mis v\u00f5imaldab ilma autentimiseta kaugelt koodi k\u00e4itada haavataval SSH-serveril. Probleemile on m\u00e4\u00e4ratud kriitiline ohtlikkuse tase (10 skaalal 10). <\/p>\n

\u00dcks turvauurijatest on juba loonud funktsionaalse eksploiidi koodi k\u00e4itamiseks haavatavates SSH-serverites. Tasub m\u00e4rkida, et uurija s\u00f5nul on kood loodud AI-assistentide GPT-4, Cursor ja Sonnet abil, l\u00e4htudes haavatavuse parandamise muudatuste anal\u00fc\u00fcsist, mis sisaldab probleemi lahendamise testi. <\/p>\n

Erlang\/OTP projekti raamatukogu pakub valmis klientide ja serverilt<\/a> SSH ja SFTP, mis toetavad SSH 2.0 protokolli. Probleemsete SSH-serverite eristamine on v\u00f5imalik nende v\u00e4ljastatava pealkirja «SSH-2.0-Erlang\/versioon» kaudu. Erlang\/OTP baasil loodud SSH-servereid kasutatakse spetsialiseeritud s\u00fcsteemides, n\u00e4iteks IoT-seadmetes ja edge-arvutustes, samuti t\u00f5rkeotsingu vahendina \u2014 Erlang v\u00f5imaldab h\u00f5lpsasti lubada SSH-serverit rakenduste kaughekseldamiseks (eeldatakse, et selline t\u00f5rkeotsingu v\u00f5imalus v\u00f5is olla lubatud paljudes Erlangis kirjutatud projektides). Probleem ilmneb ka Elixiri t\u00f6\u00f6riistade seas (mis on rakendatud Erlangi kohal) ja Phoenix raamistiku kaudu, kuid Phoenixi SSH-server ei aktsepteeri vaikimisi p\u00e4ringuid v\u00e4lisest v\u00f5rgust. <\/p>\n

Haavatavus tuleneb veast s\u00f5numite t\u00f5lgendamise koodis, mis p\u00f5hjustas SSH_MSG_CHANNEL_REQUEST s\u00f5numite, mis lubavad «exec» k\u00e4sku t\u00e4itmist, t\u00f6\u00f6tlemise autentimise etapis. N\u00e4ide koodist eksploiti: command = ‘file:write_file(«\\\/lab.txt», <<«pwned»>>).’ return ( b»\x62″ # SSH_MSG_CHANNEL_REQUEST + struct.pack(«>I», channel_id) + string_payload(«exec») + b»\x01″ # want_reply = true + string_payload(command) ) <\/p>\n

Haavatavus on k\u00f5rvaldatud versioonides Erlang\/OTP-27.3.3, 26.2.5.11 ja 25.3.2.20. Haavatavuse k\u00f5rvaldamise edenemist distributsioonides on v\u00f5imalik j\u00e4lgida j\u00e4rgmiste lehtede kaudu: Debian, Ubuntu, Fedora, SUSE\/openSUSE, RHEL, Arch, FreeBSD.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 ssh, \u0432\u0445\u043e\u0434\u044f\u0449\u0435\u0439 \u0432 \u0441\u043e\u0441\u0442\u0430\u0432 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f Erlang\/OTP, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-32433), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0431\u0435\u0437 \u043f\u0440\u043e\u0445\u043e\u0436\u0434\u0435\u043d\u0438\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0441\u0432\u043e\u0439 \u043a\u043e\u0434 \u043d\u0430 SSH-\u0441\u0435\u0440\u0432\u0435\u0440\u0435, \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u043e\u043c \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0439 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (10 \u0438\u0437 10). \u041e\u0434\u0438\u043d \u0438\u0437 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u0436\u0435 \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u0438\u043b \u0440\u0430\u0431\u043e\u0447\u0438\u0439 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442 \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 SSH-\u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445. \u041f\u0440\u0438\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u043e, \u0447\u0442\u043e \u043f\u043e \u0441\u043b\u043e\u0432\u0430\u043c \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u043a\u043e\u0434 \u0431\u044b\u043b […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-123597","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Haavatavus Erlang\/OTP SSH-serveris, mis v\u00f5imaldab kaugkoodi t\u00e4itmist | ProHoster","description":"Erlang\/OTP t\u00f6\u00f6riistade komplekti kuuluvasse ssh raamatukokku on avastatud haavatavus (CVE-2025-32433), mis v\u00f5imaldab ilma autentimiseta kaugelt koodi k\u00e4itada haavataval SSH-serveril, mis on loodud kasutades.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-ssh-servere-iz-erlang-otp-dopuskayushhaya-udalyonnoe-vypolnenie-koda","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 SSH-\u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0438\u0437 Erlang\/OTP, \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0430\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 | ProHoster","og:description":"\u0412 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 ssh, \u0432\u0445\u043e\u0434\u044f\u0449\u0435\u0439 \u0432 \u0441\u043e\u0441\u0442\u0430\u0432 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f Erlang\/OTP, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-32433), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0431\u0435\u0437 \u043f\u0440\u043e\u0445\u043e\u0436\u0434\u0435\u043d\u0438\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0441\u0432\u043e\u0439 \u043a\u043e\u0434 \u043d\u0430 SSH-\u0441\u0435\u0440\u0432\u0435\u0440\u0435, \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u043e\u043c \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-ssh-servere-iz-erlang-otp-dopuskayushhaya-udalyonnoe-vypolnenie-koda","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-04-18T13:05:07+00:00","article:modified_time":"2025-04-18T13:05:07+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"123597","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-22 15:51:24","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 12:18:19","updated":"2026-02-22 15:51:24","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/123597","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=123597"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/123597\/revisions"}],"predecessor-version":[{"id":162491,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/123597\/revisions\/162491"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=123597"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=123597"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=123597"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}