Tvrtka Qualys otkrila je kriti\u010dnu ranjivost (CVE-2024-6387) u OpenSSH-u koja omogu\u0107uje udaljeno izvr\u0161avanje koda s root pravima bez autentifikacije. Ranjivost, koja nosi kodno ime regreSSHion, o\u010dituje se u zadanoj konfiguraciji po\u010dev\u0161i od verzije OpenSSH 8.5 na sustavima sa standardnom bibliotekom Glibc. <\/p>\n
Mogu\u0107nost izvr\u0161enja napada demonstrirana je na 32-bitnom sustavu s Glibc-om s uklju\u010denom za\u0161titom ASLR (nasumi\u010dna raspodjela adresa). Za uspje\u0161an napad u laboratorijskim uvjetima bilo je potrebno 6-8 sati, tijekom kojih su se serverom<\/a> neprekidno uspostavljale veze s maksimalnom dozvoljenom intenzitetom u konfiguraciji sshd. Izvo\u0111enje napada olak\u0161ano je i zahtijeva manje vremena na sustavima bez ASLR-a ili u distribucijama koje koriste modificirani OpenSSH, u kojem je isklju\u010dena ponovna nasumi\u010dna raspodjela ASLR-a za svaku vezu. Radni prototip eksploita nije odlu\u010deno javno objaviti do potpunog uklanjanja ranjivosti, no dostupno je dovoljno detaljno opisivanje su\u0161tine ranjivosti, \u0161to \u010dini pojavu alternativnih eksploita pitanjem vremena.<\/p>\n Ne isklju\u010duje se mogu\u0107nost izvr\u0161enja napada i na 64-bitne sustave, ali radni exploit za takve sustave jo\u0161 nije spreman. Pretpostavlja se da \u0107e izvo\u0111enje napada na 64-bitne sustave trajati znatno du\u017ee, no ne dulje od tjedan dana. OpenSSH u OpenBSD-u nije podlo\u017ean ovom problemu, budu\u0107i da se u ovom sustavu od 2001. godine primjenjuje mehanizam za\u0161tite koji blokira ovakve vrste napada. U drugim sustavima koji se temelje na standardnim bibliotekama razli\u010ditim od Glibc-a, teoretski je mogu\u0107a prilagodba metode za izvr\u0161enje napada (u Qualys-u ovaj problem trenutno nije istra\u017een). <\/p>\n Ranjivost je ispravljena u danas objavljenoj verziji OpenSSH 9.8 (zakrpa). Pra\u0107enje objava a\u017euriranja paketa u distribucijama mo\u017ee se obaviti na stranicama: Debian, Ubuntu, RHEL, SUSE\/openSUSE, Fedora, ROSA, Gentoo, ALT Linux, Arch i FreeBSD. Kao zaobilazno re\u0161enje za blokiranje ranjivosti, u sshd_config mo\u017ee se postaviti parametar \u201eLoginGraceTime=0\u201c, pri \u010demu isklju\u010divanje timeouta olak\u0161ava iniciranje napada usled prekomernog broja veza koje prelaze limite zadane parametrima MaxStartups. Ranljivost je nastala kao rezultat regresivne promjene koja je uklju\u010dena u izdanju OpenSSH 8.5 i dovodi do stanja utrke u kodu za obradu signala u sshd-u. Regresija je dovela do prestanka djelovanja za\u0161tite od stare ranljivosti CVE-2006-5051, koja se manifestirala do verzije OpenSSH 4.4 (2006. godina) i imala teoretski karakter. Rukovaatelj SIGALRM se u sshd-u poziva asinkrono, ako klijent nije izvr\u0161io autentikaciju unutar vremena ograni\u010denog timeoutom za prijavu (LoginGraceTime, prema zadanim postavkama 120 sekundi). Napad se temelji na tome da rukovaatelj signala poziva funkcije koje nisu sigurne pri asinkronoj obradi signala, kao \u0161to je syslog(). Funkcija syslog() u Glibc nije predvi\u0111ena za kori\u0161tenje u asinkrono izvr\u0161avanim rukovaateljima signala, jer poziva funkcije malloc() i free(). Aktivacija signala SIGALRM, koji prekida izvr\u0161avanje odre\u0111enog koda u sshd-u, mo\u017ee dovesti do naru\u0161avanja stanja izvr\u0161avanja, a zadatak eksploita svodi se na stvaranje uvjeta za preklapanje potrebnog koda u pravi trenutak njegovog izvr\u0161avanja. Ranljivost ne utje\u010de na OpenBSD, jer se u njemu umjesto syslog() iz rukovaatelja signala SIGALRM poziva funkcija syslog_r(), koja je posebno stvorena za asinkrono pokretanje. \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Qualys \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-6387) \u0432 OpenSSH, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root \u0431\u0435\u0437 \u043f\u0440\u043e\u0445\u043e\u0436\u0434\u0435\u043d\u0438\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f regreSSHion, \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u0435\u0440\u0441\u0438\u0438 OpenSSH 8.5 \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0441\u043e \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u043e\u0439 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u043e\u0439 Glibc. \u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u043d\u0430 32-\u0440\u0430\u0437\u0440\u044f\u0434\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0441 Glibc \u0441 \u0432\u043a\u043b\u044e\u0447\u0451\u043d\u043d\u043e\u0439 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 ASLR (\u0440\u0430\u043d\u0434\u043e\u043c\u0438\u0437\u0430\u0446\u0438\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-116883","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Ranljivost u OpenSSH koja omogu\u0107uje daljinsko izvr\u0161avanje koda s pravima root na serverima s Glibc | ProHoster","description":"Tvrtka Qualys otkrila je kriti\u010dnu ranljivost (CVE-2024-6387) u OpenSSH koja omogu\u0107uje daljinsko izvr\u0161avanje koda s pravima root bez prolaska autentikacije.","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/news\/uyazvimost-v-openssh-pozvolyayushhaya-udalyonno-vypolnit-kod-s-pravami-root-na-serverah-s-glibc","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 OpenSSH, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 \u0441 Glibc | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Qualys \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-6387) \u0432 OpenSSH, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root \u0431\u0435\u0437 \u043f\u0440\u043e\u0445\u043e\u0436\u0434\u0435\u043d\u0438\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438.","og:url":"https:\/\/prohoster.info\/hr\/blog\/news\/uyazvimost-v-openssh-pozvolyayushhaya-udalyonno-vypolnit-kod-s-pravami-root-na-serverah-s-glibc","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-07-01T16:05:44+00:00","article:modified_time":"2024-07-01T16:05:44+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"116883","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 21:59:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 03:18:19","updated":"2026-02-09 21:59:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/116883","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=116883"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/116883\/revisions"}],"predecessor-version":[{"id":160364,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/116883\/revisions\/160364"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=116883"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=116883"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=116883"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\nJedan od znakova poku\u0161aja napada je pojava velikog broja unosa \u201eTimeout before authentication\u201c u logu.<\/p>\n
\nTokom razvoja OpenSSH 8.5, gre\u0161kom je iz funkcije sigdie(), koja se direktno poziva iz handlera SIGALRM, uklonjen blok \u201e#ifdef DO_LOG_SAFE_IN_SIGHAND\u201c.<\/p>\n
\n
Izvor: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"