{"id":37095,"date":"2019-10-31T22:15:43","date_gmt":"2019-10-31T19:15:43","guid":{"rendered":"https:\/\/prohoster.info\/blog\/v-razlichnyh-realizatsiyah-protokola-http-2-vyyavleno-8-dos-uyazvimostej\/"},"modified":"2019-10-31T22:15:43","modified_gmt":"2019-10-31T19:15:43","slug":"v-razlichnyh-realizatsiyah-protokola-http-2-vyyavleno-8-dos-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/v-razlichnyh-realizatsiyah-protokola-http-2-vyyavleno-8-dos-uyazvimostej","title":{"rendered":"Erinevates HTTP\/2 protokolli rakendustes on tuvastatud 8 DoS-haavatavust","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Netflixi ja Google'i teadlased <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/Netflix\/security-bulletins\/blob\/master\/advisories\/third-party\/2019-002.md\">tuvastasid<\/a><\/noindex>  leidsid erinevates HTTP\/2 protokolli rakendustes kaheksa haavatavust, mis v\u00f5imaldavad teenuse katkestamist, saates teatud viisil vormindatud v\u00f5rgup\u00e4ringute vooge. Probleemid m\u00f5jutavad enamasti enamikku HTTP\/2-ga toetatud HTTP-serveritest ning toovad kaasa t\u00f6\u00f6tamism\u00e4lu ammendumise v\u00f5i liiga k\u00f5rge koormuse CPU-le. Haavatavuste parandused on juba esitatud <noindex><a rel=\"nofollow\" href=\"http:\/\/mailman.nginx.org\/pipermail\/nginx-announce\/2019\/000247.html\">nginx 1.16.1\/1.17.3<\/a><\/noindex> ja <noindex><a rel=\"nofollow\" href=\"http:\/\/blog.kazuhooku.com\/2019\/08\/h2o-version-226-230-beta2-released.html\">H2O 2.2.6<\/a><\/noindex>, kuid praegu <noindex><a rel=\"nofollow\" href=\"http:\/\/www.apache.org\/dist\/httpd\/\">k\u00e4ttesaamatud<\/a><\/noindex> Apache httpd ja <noindex><a rel=\"nofollow\" href=\"https:\/\/www.kb.cert.org\/vuls\/id\/605641\/\">teised tooted<\/a><\/noindex>.<\/p>\n<p>Probleemid tulenesid HTTP\/2 protokolli keerukustest, mis on seotud binaarsete struktuuride kasutamise, voogude andmete piirangute s\u00fcsteemi, voogude prioriseerimise mehhanismi ja ICMP-sarnaste juhtimisv\u00f5tete olemasolu t\u00f5ttu, mis t\u00f6\u00f6tavad HTTP\/2 \u00fchendustasandil (n\u00e4iteks ping, voogude nullimise ja seadistamise toimingud). Paljud rakendused ei piiranud korralikult juhtimise s\u00f5numite voogu, korraldasid ebaefektiivselt prioriteedi t\u00f6\u00f6tlemise j\u00e4rjekorda v\u00f5i kasutasid mitteoptimeeritud voogude juhtimise algoritme.<\/p>\n<p>Enamiku tuvastatud r\u00fcnnakumeetodite puhul saadetakse serverisse teatud p\u00e4ringud, mis genereerivad suure hulga vastuseid. Kui klient ei loe andmeid pesast ja ei katka \u00fchendust, t\u00e4itub serveri poolel pidevalt vastuste vahem\u00e4lu j\u00e4rjekord. Selline k\u00e4itumine koormab v\u00f5rgu\u00fchenduste t\u00f6\u00f6tlemise j\u00e4rjekorra haldamise s\u00fcsteemi ja s\u00f5ltuvalt rakenduse erip\u00e4rast v\u00f5ib see p\u00f5hjustada m\u00e4lu v\u00f5i CPU ressursside ammendumist.<\/p>\n<p>Tuletatud haavatavused:<\/p>\n<ul>\n<li class=\"l\"> CVE-2019-9511 (Andmete \u00dclekandumine) \u2014 r\u00fcndaja k\u00fcsib suurt hulka andmeid mitmes voos, manipuleerides liikuvate akende suuruse ja voogude prioriteediga, sundides serverit andmeid j\u00e4rjekorda panema plokkidena, milles on 1 bait;\n<li class=\"l\">  CVE-2019-9512 (Ping Flood) \u2014 r\u00fcndaja saadab pidevalt ping-s\u00f5numeid l\u00e4bi HTTP\/2 \u00fchenduse, p\u00f5hjustades vastuste sisemise j\u00e4rjekorra t\u00e4itmise teisel pool;\n<li class=\"l\"> CVE-2019-9513 (Ressursits\u00fckkel) \u2014 r\u00fcndaja loob mitu p\u00e4ringuvoogu ja muudab pidevalt voogude prioriteeti, p\u00f5hjustades prioriteetide puu segunemise;\n<li class=\"l\"> CVE-2019-9514 (Reset Flood) \u2014 r\u00fcndaja loob mitu voogu<br \/>\n ja saadab iga voog kaudu vale p\u00e4ringu, mis kutsub serveri \u00fcles saatma RST_STREAM kaadreid, kuid ei v\u00f5ta neid vastuste j\u00e4rjekorra t\u00e4itmiseks;<\/p>\n<li class=\"l\"> CVE-2019-9515 (Seadete Flood) \u2014 r\u00fcndaja saadab hulga t\u00fchje \"SETTINGS\" raame, millele server peab igasuguste p\u00e4ringute vastuv\u00f5tmise kinnituseks reageerima;\n<li class=\"l\">  CVE-2019-9516 (0-Pikkusega Pealkirjade Leak) \u2014 r\u00fcndaja saadab hulga pealkirju null-nime ja null-v\u00e4\u00e4rtusega, samas kui server eraldab iga pealkirja salvestamiseks m\u00e4lu puhvert ja ei vabasta seda enne sessiooni l\u00f5ppu;\n<li class=\"l\">   CVE-2019-9517 (Sisetunne Andmebuffer) \u2014 r\u00fcndaja avab<br \/>\nlibiseva HTTP\/2 akna, et server saaks andmeid piiramata edastada, kuid hoiab samas TCP akna suletuna, mis ei v\u00f5imalda andmeid tegelikult soketti kirjutada. Seej\u00e4rel saadab r\u00fcndaja p\u00e4ringud, mis n\u00f5uavad suurt vastust;<\/p>\n<li class=\"l\"> CVE-2019-9518 (T\u00fchjade Raamide Flood) \u2014 r\u00fcndaja saadab voolu DATA, HEADERS, CONTINUATION v\u00f5i PUSH_PROMISE t\u00fc\u00fcpi raame, kuid t\u00fchja kasuliku sisuga ja ilma voolu l\u00f5petamise liputa. Server kulutab aega iga raami t\u00f6\u00f6tlemiseks, mis ei vasta r\u00fcndaja raisatud ribalaiusele.\n<\/ul>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Allikas: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=51279\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 Netflix \u0438 Google \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 HTTP\/2 \u0432\u043e\u0441\u0435\u043c\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438 \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u044b\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u043f\u043e\u0442\u043e\u043a\u0430 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0432 \u0442\u043e\u0439 \u0438\u043b\u0438 \u0438\u043d\u043e\u0439 \u043c\u0435\u0440\u0435 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0442 \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0441 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u043e\u0439 HTTP\/2 \u0438 \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0442 \u043a \u0438\u0441\u0447\u0435\u0440\u043f\u0430\u043d\u0438\u044e \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0439 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0447\u0435\u0433\u043e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430 \u043f\u0430\u043c\u044f\u0442\u0438 \u0438\u043b\u0438 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044e \u0441\u043b\u0438\u0448\u043a\u043e\u043c \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043d\u0430 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-37095","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 Netflix \u0438 Google \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/news\/v-razlichnyh-realizatsiyah-protokola-http-2-vyyavleno-8-dos-uyazvimostej\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 HTTP\/2 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 8 DoS-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 Netflix \u0438 Google \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/news\/v-razlichnyh-realizatsiyah-protokola-http-2-vyyavleno-8-dos-uyazvimostej\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:15:43+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:15:43+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Erinevates HTTP\/2 protokolli rakendustes on tuvastatud 8 DoS-haavatavust | ProHoster","description":"Netflixi ja Google'i teadlased on tuvastanud erinevates rakendustes.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/v-razlichnyh-realizatsiyah-protokola-http-2-vyyavleno-8-dos-uyazvimostej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 HTTP\/2 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 8 DoS-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 Netflix \u0438 Google \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/v-razlichnyh-realizatsiyah-protokola-http-2-vyyavleno-8-dos-uyazvimostej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:15:43+00:00","article:modified_time":"2019-10-31T19:15:43+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"37095","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 06:06:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 23:22:07","updated":"2026-01-22 06:06:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/37095","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=37095"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/37095\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=37095"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=37095"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=37095"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}