Une version corrective d'OpenSSH 9.9p2 est disponible, qui corrige deux vuln\u00e9rabilit\u00e9s d\u00e9couvertes par Qualys. Un exemple d'utilisation de ces vuln\u00e9rabilit\u00e9s pour r\u00e9aliser une attaque MITM a \u00e9t\u00e9 d\u00e9montr\u00e9, permettant de rediriger le trafic vers un serveur fictif lors de la tentative de connexion d'un client \u00e0 un serveur SSH, contournant la v\u00e9rification des cl\u00e9s h\u00f4tes et cr\u00e9ant l'illusion pour le client d'\u00eatre connect\u00e9 au serveur souhait\u00e9 (le client SSH acceptera la cl\u00e9 h\u00f4te du serveur fictif au lieu de la cl\u00e9 du serveur l\u00e9gitime). <\/p>\n
La premi\u00e8re vuln\u00e9rabilit\u00e9 (CVE-2025-26465) r\u00e9sulte d'une erreur logique dans l'outil ssh, permettant de contourner la v\u00e9rification de l'identit\u00e9 du serveur et de r\u00e9aliser une attaque MITM. Le probl\u00e8me se manifeste \u00e0 partir de la version OpenSSH 6.8p1 (d\u00e9cembre 2014) dans les configurations o\u00f9 l'option VerifyHostKeyDNS est activ\u00e9e. Dans la version par d\u00e9faut d'OpenSSH, cette option est d\u00e9sactiv\u00e9e, mais elle a \u00e9t\u00e9 activ\u00e9e dans les r\u00e9glages de ssh sur FreeBSD jusqu'en mars 2023. <\/p>\n
Le probl\u00e8me r\u00e9side dans le fait que dans le code de la fonction verify_host_key_callback(), lors de l'appel de la fonction verify_host_key(), seul le code d'erreur \u00ab -1 \u00bb est v\u00e9rifi\u00e9, tandis que d'autres codes, comme \u00ab -2 \u00bb, sont ignor\u00e9s. En cons\u00e9quence, la fonction verify_host_key_callback() peut retourner un code de r\u00e9ussite \u00ab 0 \u00bb, malgr\u00e9 le retour d'une erreur \u00ab -2 \u00bb par la fonction verify_host_key(). Le code d'erreur \u00ab -2 \u00bb est renvoy\u00e9 par la fonction verify_host_key() en cas de manque de m\u00e9moire. Si des conditions sont cr\u00e9\u00e9es qui rendent l'allocation de m\u00e9moire impossible dans la fonction verify_host_key(), SSH consid\u00e9rera que la cl\u00e9 d'h\u00f4te a \u00e9t\u00e9 v\u00e9rifi\u00e9e avec succ\u00e8s. Pour cr\u00e9er de telles conditions, un serveur SSH factice de l'attaquant, vers lequel le client est redirig\u00e9, renvoie la cl\u00e9 d'h\u00f4te de la taille maximale (256 Ko), tout en exploitant simultan\u00e9ment une fuite de m\u00e9moire du c\u00f4t\u00e9 du client SSH. <\/p>\n
Les conditions pour cr\u00e9er une fuite de m\u00e9moire sont atteintes gr\u00e2ce \u00e0 la deuxi\u00e8me vuln\u00e9rabilit\u00e9 (CVE-2025-26466), affectant \u00e0 la fois le client ssh et serveur<\/a> sshd, et exploit\u00e9 sans authentification. La vuln\u00e9rabilit\u00e9 permet d'\u00e9puiser la m\u00e9moire disponible du processus et de cr\u00e9er une forte charge sur le CPU en envoyant un grand nombre de paquets SSH2_MSG_PING. Dans le gestionnaire de paquets SSH2_MSG_PING, il y a une fuite de m\u00e9moire, apparue \u00e0 partir de la version OpenSSH 9.5p1 (ao\u00fbt 2023). La fuite se produit parce qu'un tampon de 256 octets est allou\u00e9 pour chaque paquet PING de 16 octets re\u00e7u, mais ce tampon n'est lib\u00e9r\u00e9 qu'apr\u00e8s l'ach\u00e8vement de l'accord sur les cl\u00e9s. Comme solution de contournement pour la protection, il est sugg\u00e9r\u00e9 de configurer des limites \u00e0 l'aide des directives LoginGraceTime, MaxStartups et PerSourcePenalties. \u0414\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0439 \u0432\u044b\u043f\u0443\u0441\u043a OpenSSH 9.9p2, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Qualys. \u041f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d \u043f\u0440\u0438\u043c\u0435\u0440 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0434\u0430\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0434\u043b\u044f \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f MITM-\u0430\u0442\u0430\u043a\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043f\u0440\u0438 \u043f\u043e\u043f\u044b\u0442\u043a\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u043a SSH-\u0441\u0435\u0440\u0432\u0435\u0440\u0443, \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0442\u0440\u0430\u0444\u0438\u043a \u043d\u0430 \u0441\u043e\u0431\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0439 \u0444\u0438\u043a\u0442\u0438\u0432\u043d\u044b\u0439 \u0441\u0435\u0440\u0432\u0435\u0440, \u043e\u0431\u043e\u0439\u0442\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 \u0445\u043e\u0441\u0442\u043e\u0432\u044b\u0445 \u043a\u043b\u044e\u0447\u0435\u0439 \u0438 \u0441\u043e\u0437\u0434\u0430\u0442\u044c \u0443 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u0432\u0438\u0434\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a \u0436\u0435\u043b\u0430\u0435\u043c\u043e\u043c\u0443 \u0441\u0435\u0440\u0432\u0435\u0440\u0443 (ssh-\u043a\u043b\u0438\u0435\u043d\u0442 \u043f\u0440\u0438\u043c\u0435\u0442 \u0445\u043e\u0441\u0442\u043e\u0432\u044b\u0439 \u043a\u043b\u044e\u0447 \u0444\u0438\u043a\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0432\u043c\u0435\u0441\u0442\u043e \u043a\u043b\u044e\u0447\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-121998","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Mise \u00e0 jour d'OpenSSH 9.9p2 \u00e9liminant la possibilit\u00e9 d'attaques MITM | ProHoster","description":"Une version corrective d'OpenSSH 9.9p2 est disponible, corrigeant deux vuln\u00e9rabilit\u00e9s identifi\u00e9es par Qualys.","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/news\/obnovlenie-openssh-9-9p2-s-ustraneniem-vozmozhnosti-soversheniya-mitm-ataki","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 OpenSSH 9.9p2 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f MITM-\u0430\u0442\u0430\u043a\u0438 | ProHoster","og:description":"\u0414\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0439 \u0432\u044b\u043f\u0443\u0441\u043a OpenSSH 9.9p2, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Qualys.","og:url":"https:\/\/prohoster.info\/fr\/blog\/news\/obnovlenie-openssh-9-9p2-s-ustraneniem-vozmozhnosti-soversheniya-mitm-ataki","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-02-18T18:22:04+00:00","article:modified_time":"2025-02-18T18:22:04+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"121998","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 10:42:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 10:42:19","updated":"2026-01-23 10:42:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/121998","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=121998"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/121998\/revisions"}],"predecessor-version":[{"id":173038,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/121998\/revisions\/173038"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=121998"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=121998"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=121998"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Source : opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"