A empresa Qualys identificou uma vulnerabilidade cr\u00edtica (CVE-2024-6387) no OpenSSH, que permite a execu\u00e7\u00e3o remota de c\u00f3digo com privil\u00e9gios de root sem autentica\u00e7\u00e3o. A vulnerabilidade, codinome regreSSHion, se manifesta na configura\u00e7\u00e3o padr\u00e3o a partir da vers\u00e3o OpenSSH 8.5 em sistemas com a biblioteca padr\u00e3o Glibc. <\/p>\n
A possibilidade de realizar um ataque foi demonstrada em um sistema de 32 bits com Glibc, com a prote\u00e7\u00e3o ASLR (aleatoriza\u00e7\u00e3o do espa\u00e7o de endere\u00e7amento) ativada. Para um ataque bem-sucedido em condi\u00e7\u00f5es laboratoriais, foram necess\u00e1rios de 6 a 8 horas, durante as quais se servidor<\/a> estabeleceram continuamente conex\u00f5es com a intensidade m\u00e1xima permitida na configura\u00e7\u00e3o do sshd. A realiza\u00e7\u00e3o do ataque \u00e9 facilitada e requer menos tempo em sistemas sem ASLR ou em distribui\u00e7\u00f5es que utilizam OpenSSH modificado, no qual a re-aleatoriza\u00e7\u00e3o ASLR para cada conex\u00e3o est\u00e1 desativada. Um prot\u00f3tipo funcional do exploit n\u00e3o ser\u00e1 publicado publicamente at\u00e9 que a vulnerabilidade seja amplamente corrigida, mas uma descri\u00e7\u00e3o detalhada da natureza da vulnerabilidade est\u00e1 dispon\u00edvel, tornando o aparecimento de exploits de terceiros uma quest\u00e3o de tempo.<\/p>\n N\u00e3o se descarta a possibilidade de ataques tamb\u00e9m em sistemas de 64 bits, mas um exploit funcional para esses sistemas ainda n\u00e3o est\u00e1 pronto. Sup\u00f5e-se que a realiza\u00e7\u00e3o de um ataque em sistemas de 64 bits levar\u00e1 muito mais tempo, mas n\u00e3o mais de uma semana. O OpenSSH no OpenBSD n\u00e3o \u00e9 vulner\u00e1vel ao problema, pois este sistema aplica desde 2001 um mecanismo de prote\u00e7\u00e3o que bloqueia classes similares de ataques. Em outros sistemas com base em bibliotecas padr\u00e3o diferentes da Glibc, a adapta\u00e7\u00e3o do m\u00e9todo para realizar um ataque \u00e9 teoricamente poss\u00edvel (na Qualys, esta quest\u00e3o ainda n\u00e3o foi estudada). <\/p>\n A vulnerabilidade foi corrigida na vers\u00e3o publicada hoje do OpenSSH 9.8 (patch). \u00c9 poss\u00edvel acompanhar a publica\u00e7\u00e3o de atualiza\u00e7\u00f5es de pacotes nas distribui\u00e7\u00f5es nas p\u00e1ginas: Debian, Ubuntu, RHEL, SUSE\/openSUSE, Fedora, ROSA, Gentoo, ALT Linux, Arch e FreeBSD. Como uma solu\u00e7\u00e3o alternativa para bloquear a vulnerabilidade em sshd_config, o par\u00e2metro \u00abLoginGraceTime=0\u00bb pode ser definido; no entanto, desativar o tempo limite facilitar\u00e1 a inicia\u00e7\u00e3o de uma nega\u00e7\u00e3o de servi\u00e7o com um grande n\u00famero de conex\u00f5es, excedendo os limites estabelecidos pelo par\u00e2metro MaxStartups. A vulnerabilidade surgiu como resultado de uma altera\u00e7\u00e3o regressiva inclu\u00edda na vers\u00e3o do OpenSSH 8.5, que leva a uma condi\u00e7\u00e3o de corrida no c\u00f3digo de processamento de sinais no sshd. A regress\u00e3o resultou na desativa\u00e7\u00e3o da prote\u00e7\u00e3o contra uma antiga vulnerabilidade CVE-2006-5051, que se manifestava at\u00e9 a vers\u00e3o 4.4 do OpenSSH (2006) e tinha um car\u00e1ter te\u00f3rico. O manipulador SIGALRM \u00e9 chamado no sshd de forma ass\u00edncrona, se o cliente n\u00e3o conseguiu se autenticar dentro do tempo limitado pelo timeout de conex\u00e3o (LoginGraceTime, padr\u00e3o de 120 segundos). O ataque baseia-se no fato de que o manipulador de sinais chama fun\u00e7\u00f5es que n\u00e3o s\u00e3o seguras durante o processamento ass\u00edncrono de sinais, como syslog(). A fun\u00e7\u00e3o syslog() na Glibc n\u00e3o \u00e9 projetada para uso em manipuladores de sinais executados de forma ass\u00edncrona, pois chama as fun\u00e7\u00f5es malloc() e free(). A ativa\u00e7\u00e3o do sinal SIGALRM, que interrompe um c\u00f3digo espec\u00edfico no sshd, pode levar a uma viola\u00e7\u00e3o do estado de execu\u00e7\u00e3o, e o objetivo do exploit \u00e9 criar condi\u00e7\u00f5es para interromper o c\u00f3digo necess\u00e1rio no momento certo de sua execu\u00e7\u00e3o. A vulnerabilidade n\u00e3o afeta o OpenBSD, pois nele, em vez de syslog() no manipulador de sinais SIGALRM, \u00e9 chamada a fun\u00e7\u00e3o syslog_r(), especificamente criada para execu\u00e7\u00e3o ass\u00edncrona. \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Qualys \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-6387) \u0432 OpenSSH, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root \u0431\u0435\u0437 \u043f\u0440\u043e\u0445\u043e\u0436\u0434\u0435\u043d\u0438\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f regreSSHion, \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u0435\u0440\u0441\u0438\u0438 OpenSSH 8.5 \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0441\u043e \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u043e\u0439 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u043e\u0439 Glibc. \u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u043d\u0430 32-\u0440\u0430\u0437\u0440\u044f\u0434\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0441 Glibc \u0441 \u0432\u043a\u043b\u044e\u0447\u0451\u043d\u043d\u043e\u0439 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 ASLR (\u0440\u0430\u043d\u0434\u043e\u043c\u0438\u0437\u0430\u0446\u0438\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-116883","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Vulnerabilidade no OpenSSH, permitindo a execu\u00e7\u00e3o remota de c\u00f3digo com privil\u00e9gios de root em servidores com Glibc | ProHoster","description":"A empresa Qualys identificou uma vulnerabilidade cr\u00edtica (CVE-2024-6387) no OpenSSH, permitindo a execu\u00e7\u00e3o remota de c\u00f3digo com privil\u00e9gios de root sem passar pela autentica\u00e7\u00e3o.","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/news\/uyazvimost-v-openssh-pozvolyayushhaya-udalyonno-vypolnit-kod-s-pravami-root-na-serverah-s-glibc","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 OpenSSH, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 \u0441 Glibc | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Qualys \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-6387) \u0432 OpenSSH, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root \u0431\u0435\u0437 \u043f\u0440\u043e\u0445\u043e\u0436\u0434\u0435\u043d\u0438\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438.","og:url":"https:\/\/prohoster.info\/pt\/blog\/news\/uyazvimost-v-openssh-pozvolyayushhaya-udalyonno-vypolnit-kod-s-pravami-root-na-serverah-s-glibc","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-07-01T16:05:44+00:00","article:modified_time":"2024-07-01T16:05:44+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"116883","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 21:59:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 03:18:19","updated":"2026-02-09 21:59:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/116883","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=116883"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/116883\/revisions"}],"predecessor-version":[{"id":160364,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/116883\/revisions\/160364"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=116883"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=116883"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=116883"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\nUm dos sinais de tentativas de ataque \u00e9 o aparecimento no log de um grande n\u00famero de registros \u00abTimeout before authentication\u00bb.<\/p>\n
\nDurante o desenvolvimento do OpenSSH 8.5, um bloco \u00ab#ifdef DO_LOG_SAFE_IN_SIGHAND\u00bb foi removido por engano da fun\u00e7\u00e3o sigdie(), que \u00e9 chamada diretamente do manipulador SIGALRM.<\/p>\n
\n
Fonte: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"