{"id":87197,"date":"2020-07-05T07:42:02","date_gmt":"2020-07-05T05:42:02","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-ssh-klientah-openssh-i-putty"},"modified":"2020-07-05T07:42:02","modified_gmt":"2020-07-05T05:42:02","slug":"uyazvimost-v-ssh-klientah-openssh-i-putty","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-ssh-klientah-openssh-i-putty","title":{"rendered":"Haavatavus SSH-klientides OpenSSH ja PuTTY","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

OpenSSH ja PuTTY SSH-kliendid tuvastatud<\/a><\/noindex> haavatavus<\/a><\/noindex> (CVE-2020-14002<\/a><\/noindex> PuTTY ja CVE-2020-14145<\/a><\/noindex> OpenSSH-s), mis toob kaasa teabe lekkimise \u00fchenduse lepingute algoritmis. Haavatavus v\u00f5imaldab r\u00fcndajal, kes suudab klientide liikluse pealt kuulata (n\u00e4iteks kui kasutaja \u00fchendub r\u00fcndaja kontrolli all oleva traadita juurdep\u00e4\u00e4supunktiga), tuvastada kliendi esialgse \u00fchenduse katse hostiga, kui kliendi s\u00fcsteemi ei ole veel hosti v\u00f5tit vahem\u00e4llu salvestatud. <\/p>\n

Teades, et klient p\u00fc\u00fcab esmakordselt \u00fchendust luua ja tal ei ole veel oma k\u00fcljel hosti v\u00f5tit, saab r\u00fcndaja suunata \u00fchenduse enda kaudu (MITM) ja esitada kliendile oma hosti v\u00f5tme, mida SSH-kliendi pidada sihthosti v\u00f5tmena, kui v\u00f5tme s\u00f5rmej\u00e4lge ei kontrollita. Seega saab r\u00fcndaja korraldada MITM-i, tekitamata kahtlusi kasutajas, ning ignoreerida seansse, mille puhul kliendi k\u00fcljel on juba olemas vahem\u00e4llu salvestatud hosti v\u00f5tmed, mille asendamise katse toob kaasa hoiatuse hosti v\u00f5tme muutumise kohta. R\u00fcnnak p\u00f5hineb kasutajate hooletusel, kes ei kontrolli hosti v\u00f5tme s\u00f5rmej\u00e4lge esmakordsel \u00fchendamisel. Need, kes kontrollivad v\u00f5tme s\u00f5rmej\u00e4lgi, on sarnaste r\u00fcnnakute eest kaitstud.<\/p>\n

Esmakordse \u00fchenduse katse tuvastamise tunnusena kasutatakse hosti v\u00f5tme algoritmide toetatud algoritmide loendamise j\u00e4rjekorra muutumist. Kui toimub esimene \u00fchendus, edastab klient vaikimisi algoritmide loendi, ja kui hosti v\u00f5ti on juba vahem\u00e4llu salvestatud, then vastav algoritm t\u00f5stetakse esikohale (algoritmid j\u00e4rjestatakse eelistuse j\u00e4rgi). <\/p>\n

Probleem ilmneb OpenSSH versioonides alates 5.7 kuni 8.3 ja PuTTY versioonides 0.68 kuni 0.73. Probleem on k\u00f5rvaldatud<\/a><\/noindex> v\u00e4ljaandes PuTTY 0.74<\/a><\/noindex> metoodika d\u00fcnaamilise hosti v\u00f5tme algoritmide loendi koostamise v\u00f5imaluse v\u00e4ljal\u00fclitamise lisamise kaudu, eelistades algoritmide loetlemist p\u00fcsivalt.<\/p>\n

OpenSSH projekt ei kavatse muuta SSH-klientide k\u00e4itumist, kuna kui algoritmi olemasolevat v\u00f5tme osas ei ole esimesena m\u00e4\u00e4ratud, proovib see rakendada algoritmi, mis ei vasta vahem\u00e4lus talle vastavale v\u00f5tmele, andes hoiatuse tundmatu v\u00f5tme kohta. See t\u00e4hendab, et valiku ees on kas teabe leke (OpenSSH ja PuTTY) v\u00f5i v\u00f5tme vahetamise hoiatuste kuvamine (Dropbear SSH), juhul kui salvestatud v\u00f5ti ei vasta nimekirja esimeses osas vaikimisi olevale algoritmile.<\/p>\n

OpenSSH-s soovitatakse kaitse tagamiseks kasutada alternatiivseid meetodeid hostiv\u00f5tme kontrollimiseks, kasutades DNSSEC-i SSHFP sissekandeid ja hostide sertifikaate (PKI). Samuti on v\u00f5imalik keelata kohandatud hostiv\u00f5tme algoritmide valik, kasutades valikut HostKeyAlgorithms, ja kasutada valikut UpdateHostKeys, et klient saaks t\u00e4iendavaid hostiv\u00f5tmeid p\u00e4rast autentimist.<\/p>\n

<\/a><\/noindex><\/p>\n

Allikas: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 SSH-\u043a\u043b\u0438\u0435\u043d\u0442\u0430\u0445 OpenSSH \u0438 PuTTY \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2020-14002 \u0432 PuTTY \u0438 CVE-2020-14145 \u0432 OpenSSH), \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u0443\u0442\u0435\u0447\u043a\u0435 \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u0439 \u0432 \u0430\u043b\u0433\u043e\u0440\u0438\u0442\u043c\u0435 \u0441\u043e\u0433\u043b\u0430\u0441\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443, \u0441\u043f\u043e\u0441\u043e\u0431\u043d\u043e\u043c\u0443 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0438\u0442\u044c \u0442\u0440\u0430\u0444\u0438\u043a \u043a\u043b\u0438\u0435\u043d\u0442\u0430 (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043f\u0440\u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0447\u0435\u0440\u0435\u0437 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u0443\u044e \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u043c \u0442\u043e\u0447\u043a\u0443 \u0431\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430), \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u043f\u043e\u043f\u044b\u0442\u043a\u0443 \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u043a \u0445\u043e\u0441\u0442\u0443, \u043a\u043e\u0433\u0434\u0430 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u043c \u0435\u0449\u0451 \u043d\u0435 \u043f\u0440\u043e\u043a\u044d\u0448\u0438\u0440\u043e\u0432\u0430\u043d \u043a\u043b\u044e\u0447 \u0445\u043e\u0441\u0442\u0430. \u0417\u043d\u0430\u044f, \u0447\u0442\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-87197","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Rikked OpenSSH ja PuTTY SSH-kliendides | ProHoster","description":"OpenSSH ja PuTTY SSH-kliendid","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-ssh-klientah-openssh-i-putty","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 SSH-\u043a\u043b\u0438\u0435\u043d\u0442\u0430\u0445 OpenSSH \u0438 PuTTY | ProHoster","og:description":"\u0412 SSH-\u043a\u043b\u0438\u0435\u043d\u0442\u0430\u0445 OpenSSH \u0438 PuTTY","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-ssh-klientah-openssh-i-putty","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-07-05T05:42:02+00:00","article:modified_time":"2020-07-05T05:42:02+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"87197","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 13:56:23","updated":"2022-10-07 22:11:57","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/87197","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=87197"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/87197\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=87197"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=87197"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=87197"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}