{"id":83061,"date":"2020-05-28T01:42:22","date_gmt":"2020-05-27T23:42:22","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/reliz-openssh-8-3-s-ustraneniem-uyazvimosti-v-scp"},"modified":"2020-05-28T01:42:22","modified_gmt":"2020-05-27T23:42:22","slug":"reliz-openssh-8-3-s-ustraneniem-uyazvimosti-v-scp","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/reliz-openssh-8-3-s-ustraneniem-uyazvimosti-v-scp","title":{"rendered":"OpenSSH 8.3 v\u00e4ljaandmine koos scp haavatavuse k\u00f5rvaldamisega","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>P\u00e4rast kolme kuu arendust\u00f6\u00f6d <noindex><a rel=\"nofollow\" href=\"https:\/\/lists.mindrot.org\/pipermail\/openssh-unix-dev\/2020-May\/038528.html\">esitati<\/a><\/noindex> vabastus <noindex><a rel=\"nofollow\" href=\"https:\/\/www.openssh.com\/\">OpenSSH 8.3<\/a><\/noindex>, avatud kliendi ja serveri teostus SSH 2.0 ja SFTP protokollide jaoks. <\/p>\n<p>Uues versioonis on lisatud kaitse scp r\u00fcnnaku vastu, mis v\u00f5imaldab serveril edastada teisi failinimesid, mis erinevad n\u00f5utud omadest (erinevalt <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=49953\">eelmisest haavatavusest<\/a><\/noindex>, see r\u00fcnnak ei v\u00f5imalda valida kasutaja poolt katalooge ega glob-maske). Tuletame meelde, et SCP-enam server otsustab, milliseid faile ja katalooge klientidele saata, ning klient kontrollib vaid tagastatud objektide nimesid. Tuvastatud probleemi olemus on see, et kui s\u00fcsteemikutsung utimes l\u00f5petab talitlush\u00e4ire, siis t\u00f5lgendatakse faili sisu kui faili metaandmeid. <\/p>\n<p>See, et omadus \u00fchenduda serveriga, mis on kurjategija kontrolli all, saab kasutada, et salvestada kasutaja failis\u00fcsteemis teisi failinimesid ja muud sisu, kui kopeerides scp kaudu konfigureeringutes, mis p\u00f5hjustavad utimes'i kutse eba\u00f5nnestumise (n\u00e4iteks kui utimes on keelatud SELinuxi poliitika v\u00f5i s\u00fcsteemikutsumise filtriga). Reaalse r\u00fcnnaku t\u00f5en\u00e4osus on hinnanguliselt minimaalne, kuna t\u00fc\u00fcpilistes konfigureeringutes utimes'i kutse ei eba\u00f5nnestu. Lisaks sellele ei j\u00e4\u00e4 r\u00fcnnak m\u00e4rkamatuks \u2014 scp kutse ajal kuvatakse andmeedastusviga.<\/p>\n<p>\u00dcldised muudatused:<\/p>\n<ul>\n<li class=\"l\"> sftp-s on argumendi \u00ab-1\u00bb k\u00e4sitlemine l\u00f5petatud, sarnaselt ssh ja scp-ga, millel see varem aktsepteeriti, kuid ignoreeriti;\n<li class=\"l\"> sshd-s, kui kasutatakse IgnoreRhosts'i, pakutakse n\u00fc\u00fcd kolme valikut: \u00abjah\u00bb \u2014 ignoreerida rhosts\/shosts, \u00abei\u00bb \u2014 arvestada rhosts\/shosts-ga ja \u00abainult shosts\u00bb \u2014 lubada \u00ab.shosts\u00bb, kuid keelata \u00ab.rhosts\u00bb;\n<li class=\"l\"> ssh-s on tagatud %TOKEN asendamine LocalFoward ja RemoteForward seadistustes, mida kasutatakse Unix-soketite suunamiseks;\n<li class=\"l\"> Lubatud on laadida avatud v\u00f5tmeid kr\u00fcpteerimata privaatv\u00f5tme failist, kui eraldi avatud v\u00f5tme faili ei ole;\n<li class=\"l\"> Kui s\u00fcsteemis on libcrypto, siis ssh ja sshd n\u00fc\u00fcd kasutavad selle teegi chacha20 algoritmi teostust, mitte sisseehitatud \u00fclekandeteostust, mis j\u00e4\u00e4b tootlikkuses maha;\n<li class=\"l\"> On rakendatud v\u00f5imalus dumpida tagasiv\u00f5etud sertifikaatide binaarsete loendite sisu, kui k\u00e4ivitatakse k\u00e4sk \u00abssh-keygen -lQf \/path\u00bb;\n<li class=\"l\"> Kantav versioon v\u00f5imaldab m\u00e4\u00e4rata s\u00fcsteeme, kus SA_RESTART valiku signaalid katkestavad select t\u00f6\u00f6;\n<li class=\"l\"> Probleemid HP\/UX ja AIX s\u00fcsteemide kokkupanekuga on lahendatud;\n<li class=\"l\"> Seccomp sandboxi koostamisprobleemid m\u00f5nedes Linuxi konfigureerimistes on k\u00f5rvaldatud;\n<li class=\"l\"> Omandatud on paremad rakendused libfido2 teegi m\u00e4\u00e4ramisel ning lahendatud on koostamisprobleemid valikuga \u00ab--with-security-key-builtin\u00bb.\n<\/ul>\n<p>OpenSSH arendajad on taas hoiatanud, et SHA-1 hash\u2019ide kasutamiseks m\u00f5eldud algoritmid muudetakse peagi vananenuks, seoses <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=52149\">t\u00f5hususe<\/a><\/noindex> efektiivsuse kollisioonir\u00fcnnakute jaoks m\u00e4\u00e4ratud eelistuste suhtes (kollisiooni leidmise kulud on umbes 45 tuhat dollarit). \u00dches j\u00e4rgmistest v\u00e4ljaannetest plaanitakse vaikev\u00e4\u00e4rtusena keelata avaliku v\u00f5tme digitaalsete allkirjade algoritmi 'ssh-rsa' kasutamine, mida mainitakse SSH protokolli algses RFC-s ja mis on praktikas endiselt laialdaselt levinud (ssh-rsa rakendamise kontrollimiseks oma s\u00fcsteemides v\u00f5ib proovida ssh-\u00fchenduse loomist valikuga '-oHostKeyAlgorithms=-ssh-rsa').<\/p>\n<p>Uute algoritmide \u00fclemineku sujuvamaks muutmiseks OpenSSH-s, plaanitakse \u00fches j\u00e4rgnevates v\u00e4ljaannetes vaikimisi lubada seadistust UpdateHostKeys, mis v\u00f5imaldab automaatselt suunata kliente usaldusv\u00e4\u00e4rsematele algoritmidele. Soovitatud migreerimise algoritmide seas on rsa-sha2-256\/512, mis p\u00f5hineb RFC8332 RSA SHA-2 (toetatakse OpenSSH 7.2 alates ja kasutatakse vaikimisi), ssh-ed25519 (toetatakse OpenSSH 6.5 alates) ja ecdsa-sha2-nistp256\/384\/521, mis p\u00f5hineb RFC5656 ECDSA (toetatakse OpenSSH 5.7 alates). <\/p>\n<p>Alates eelmisest v\u00e4ljaandest on \u00abssh-rsa\u00bb ja \u00abdiffie-hellman-group14-sha1\u00bb eemaldatud CASignatureAlgorithms loendist, mis m\u00e4\u00e4ratleb uute sertifikaatide allkirjastamiseks lubatud algoritmid, kuna SHA-1 kasutamine sertifikaatides on seotud t\u00e4iendava riskiga, kuna r\u00fcndajal on piiramatu aeg olemasoleva sertifikaadi kollisiooni leidmiseks, samas kui r\u00fcndek\u00e4igud hosti v\u00f5tmete puhul on piiratud \u00fchenduse taotlemise ajaga (LoginGraceTime). <\/p>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Allikas: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=53039\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u043e\u0441\u043b\u0435 \u0442\u0440\u0451\u0445 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 OpenSSH 8.3, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430\u043c SSH 2.0 \u0438 SFTP. \u0412 \u043d\u043e\u0432\u043e\u043c \u0432\u044b\u043f\u0443\u0441\u043a\u0435 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0430 \u0437\u0430\u0449\u0438\u0442\u0430 \u043e\u0442 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 scp, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0441\u0435\u0440\u0432\u0435\u0440\u0443 \u043f\u0435\u0440\u0435\u0434\u0430\u0442\u044c \u0434\u0440\u0443\u0433\u0438\u0435 \u0438\u043c\u0435\u043d\u0430 \u0444\u0430\u0439\u043b\u043e\u0432, \u043e\u0442\u043b\u0438\u0447\u0430\u044e\u0449\u0438\u0435\u0441\u044f \u043e\u0442 \u0437\u0430\u043f\u0440\u043e\u0448\u0435\u043d\u043d\u044b\u0445 (\u0432 \u043e\u0442\u043b\u0438\u0447\u0438\u0435 \u043e\u0442 \u043f\u0440\u043e\u0448\u043b\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0430\u0442\u0430\u043a\u0430 \u043d\u0435 \u0434\u0430\u0451\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0441\u043c\u0435\u043d\u0438\u0442\u044c \u0432\u044b\u0431\u0440\u0430\u043d\u043d\u044b\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c \u043a\u0430\u0442\u0430\u043b\u043e\u0433 \u0438\u043b\u0438 glob-\u043c\u0430\u0441\u043a\u0443). \u041d\u0430\u043f\u043e\u043c\u043d\u0438\u043c, [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-83061","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u043e\u0441\u043b\u0435 \u0442\u0440\u0451\u0445 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/news\/reliz-openssh-8-3-s-ustraneniem-uyazvimosti-v-scp\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0420\u0435\u043b\u0438\u0437 OpenSSH 8.3 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 scp | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u043e\u0441\u043b\u0435 \u0442\u0440\u0451\u0445 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/news\/reliz-openssh-8-3-s-ustraneniem-uyazvimosti-v-scp\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-05-27T23:42:22+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-05-27T23:42:22+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47OpenSSH 8.3 v\u00e4ljaanne koos scp haavatavuse k\u00f5rvaldamisega | ProHoster","description":"P\u00e4rast kolme kuu arendust on v\u00e4lja antud v\u00e4ljaanne","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/reliz-openssh-8-3-s-ustraneniem-uyazvimosti-v-scp","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u043b\u0438\u0437 OpenSSH 8.3 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 scp | ProHoster","og:description":"\u041f\u043e\u0441\u043b\u0435 \u0442\u0440\u0451\u0445 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/reliz-openssh-8-3-s-ustraneniem-uyazvimosti-v-scp","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-05-27T23:42:22+00:00","article:modified_time":"2020-05-27T23:42:22+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"83061","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 15:25:24","updated":"2022-10-02 17:17:29","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/83061","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=83061"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/83061\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=83061"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=83061"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=83061"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}