{"id":83061,"date":"2020-05-28T01:42:22","date_gmt":"2020-05-27T23:42:22","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/reliz-openssh-8-3-s-ustraneniem-uyazvimosti-v-scp"},"modified":"2020-05-28T01:42:22","modified_gmt":"2020-05-27T23:42:22","slug":"reliz-openssh-8-3-s-ustraneniem-uyazvimosti-v-scp","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pt\/blog\/news\/reliz-openssh-8-3-s-ustraneniem-uyazvimosti-v-scp","title":{"rendered":"Lan\u00e7amento do OpenSSH 8.3 corrigindo vulnerabilidade no scp","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Ap\u00f3s tr\u00eas meses de desenvolvimento <noindex><a rel=\"nofollow\" href=\"https:\/\/lists.mindrot.org\/pipermail\/openssh-unix-dev\/2020-May\/038528.html\">apresentado<\/a><\/noindex> lan\u00e7amento <noindex><a rel=\"nofollow\" href=\"https:\/\/www.openssh.com\/\">OpenSSH 8.3<\/a><\/noindex>, uma implementa\u00e7\u00e3o aberta de cliente e servidor para trabalhar com os protocolos SSH 2.0 e SFTP. <\/p>\n<p>A nova vers\u00e3o inclui prote\u00e7\u00e3o contra ataques ao scp, permitindo que o servidor transfira outros nomes de arquivos que diferem dos solicitados (diferente da <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=49953\">vulnerabilidade anterior<\/a><\/noindex>, o ataque n\u00e3o permite que o diret\u00f3rio ou m\u00e1scara glob selecionados pelo usu\u00e1rio sejam alterados). Lembramos que no SCP, o servidor decide quais arquivos e diret\u00f3rios enviar ao cliente, enquanto o cliente apenas verifica a validade dos nomes de objetos retornados. A ess\u00eancia do problema identificado \u00e9 que, se a chamada de sistema utimes falha, o conte\u00fado do arquivo \u00e9 interpretado como metadados do arquivo. <\/p>\n<p>Esta caracter\u00edstica ao se conectar a um servidor sob controle de um invasor pode ser utilizada para salvar na FS do usu\u00e1rio outros nomes de arquivos e outros conte\u00fados ao copiar usando scp em configura\u00e7\u00f5es que levam a falhas ao invocar utimes (por exemplo, com a proibi\u00e7\u00e3o de utimes pela pol\u00edtica do SELinux ou por um filtro de chamadas de sistema). A probabilidade de ataques reais \u00e9 considerada m\u00ednima, pois em configura\u00e7\u00f5es t\u00edpicas a chamada utimes n\u00e3o falha. Al\u00e9m disso, o ataque n\u00e3o passa despercebido \u2014 ao invocar scp, aparece um erro de transmiss\u00e3o de dados.<\/p>\n<p>Mudan\u00e7as gerais:<\/p>\n<ul>\n<li class=\"l\"> No sftp, o tratamento do argumento \u00ab-1\u00bb foi interrompido de forma an\u00e1loga ao ssh e ao scp, que antes era aceito, mas ignorado;\n<li class=\"l\"> No sshd, ao usar IgnoreRhosts agora s\u00e3o oferecidas tr\u00eas op\u00e7\u00f5es de escolha: \u00abyes\u00bb \u2014 ignorar rhosts\/shosts, \u00abno\u00bb \u2014 considerar rhosts\/shosts e \u00abshosts-only\u00bb \u2014 permitir \u00ab.shosts\u00bb, mas proibir \u00ab.rhosts\u00bb;\n<li class=\"l\"> No ssh, a substitui\u00e7\u00e3o %TOKEN foi implementada nas configura\u00e7\u00f5es LocalFoward e RemoteForward, utilizadas para redirecionar soquetes Unix;\n<li class=\"l\"> Agora \u00e9 permitido carregar chaves p\u00fablicas de um arquivo n\u00e3o criptografado com a chave privada, se n\u00e3o houver um arquivo separado com a chave p\u00fablica;\n<li class=\"l\"> Com a libcrypto dispon\u00edvel no sistema, o ssh e o sshd agora utilizam a implementa\u00e7\u00e3o do algoritmo chacha20 dessa biblioteca, em vez da implementa\u00e7\u00e3o port\u00e1til embutida, que fica atr\u00e1s em termos de desempenho;\n<li class=\"l\"> Implementada a possibilidade de despejar o conte\u00fado da lista bin\u00e1ria de certificados revogados ao executar o comando \u00abssh-keygen -lQf \/path\u00bb;\n<li class=\"l\"> Na vers\u00e3o port\u00e1til, foi implementada a defini\u00e7\u00e3o de sistemas em que sinais com a op\u00e7\u00e3o SA_RESTART interrompem o funcionamento do select;\n<li class=\"l\"> Resolvemos problemas de compila\u00e7\u00e3o em sistemas HP\/UX e AIX.\n<li class=\"l\"> Foram resolvidos problemas com a montagem do sandbox seccomp em algumas configura\u00e7\u00f5es do Linux;\n<li class=\"l\"> Melhorada a detec\u00e7\u00e3o da biblioteca libfido2 e resolvidos problemas de compila\u00e7\u00e3o com a op\u00e7\u00e3o \u00ab--with-security-key-builtin\u00bb.\n<\/ul>\n<p>Os desenvolvedores do OpenSSH tamb\u00e9m alertaram novamente sobre a iminente descontinua\u00e7\u00e3o dos algoritmos que utilizam hashes SHA-1, devido a <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=52149\">aumento<\/a><\/noindex> a efic\u00e1cia dos ataques de colis\u00e3o com um prefixo definido (o custo de encontrar uma colis\u00e3o \u00e9 estimado em cerca de 45 mil d\u00f3lares). Uma das pr\u00f3ximas vers\u00f5es planeja desativar por padr\u00e3o a possibilidade de usar o algoritmo de assinatura digital de chave p\u00fablica &#171;ssh-rsa&#187;, que \u00e9 mencionado no RFC original para o protocolo SSH e continua amplamente utilizado na pr\u00e1tica (para verificar a aplica\u00e7\u00e3o do ssh-rsa em seus sistemas, voc\u00ea pode tentar se conectar via ssh com a op\u00e7\u00e3o &#171;-oHostKeyAlgorithms=-ssh-rsa&#187;).<\/p>\n<p>Para suavizar a transi\u00e7\u00e3o para novos algoritmos no OpenSSH, em uma das pr\u00f3ximas vers\u00f5es, ser\u00e1 ativada por padr\u00e3o a configura\u00e7\u00e3o UpdateHostKeys, que permitir\u00e1 transferir automaticamente os clientes para algoritmos mais seguros. Entre os algoritmos recomendados para migra\u00e7\u00e3o est\u00e3o rsa-sha2-256\/512 com base no RFC8332 RSA SHA-2 (suportado desde o OpenSSH 7.2 e utilizado por padr\u00e3o), ssh-ed25519 (suportado desde o OpenSSH 6.5) e ecdsa-sha2-nistp256\/384\/521 com base no RFC5656 ECDSA (suportado desde o OpenSSH 5.7). <\/p>\n<p>A partir da \u00faltima vers\u00e3o, \u00abssh-rsa\u00bb e \u00abdiffie-hellman-group14-sha1\u00bb foram removidos da lista CASignatureAlgorithms, que define os algoritmos permitidos para a assinatura digital de novos certificados, uma vez que o uso do SHA-1 em certificados acarreta riscos adicionais, j\u00e1 que um invasor tem tempo ilimitado para encontrar uma colis\u00e3o para um certificado existente, enquanto o tempo de ataque a chaves host \u00e9 limitado pelo tempo limite de conex\u00e3o (LoginGraceTime). <\/p>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Fonte: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=53039\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u043e\u0441\u043b\u0435 \u0442\u0440\u0451\u0445 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 OpenSSH 8.3, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430\u043c SSH 2.0 \u0438 SFTP. \u0412 \u043d\u043e\u0432\u043e\u043c \u0432\u044b\u043f\u0443\u0441\u043a\u0435 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0430 \u0437\u0430\u0449\u0438\u0442\u0430 \u043e\u0442 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 scp, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0441\u0435\u0440\u0432\u0435\u0440\u0443 \u043f\u0435\u0440\u0435\u0434\u0430\u0442\u044c \u0434\u0440\u0443\u0433\u0438\u0435 \u0438\u043c\u0435\u043d\u0430 \u0444\u0430\u0439\u043b\u043e\u0432, \u043e\u0442\u043b\u0438\u0447\u0430\u044e\u0449\u0438\u0435\u0441\u044f \u043e\u0442 \u0437\u0430\u043f\u0440\u043e\u0448\u0435\u043d\u043d\u044b\u0445 (\u0432 \u043e\u0442\u043b\u0438\u0447\u0438\u0435 \u043e\u0442 \u043f\u0440\u043e\u0448\u043b\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0430\u0442\u0430\u043a\u0430 \u043d\u0435 \u0434\u0430\u0451\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0441\u043c\u0435\u043d\u0438\u0442\u044c \u0432\u044b\u0431\u0440\u0430\u043d\u043d\u044b\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c \u043a\u0430\u0442\u0430\u043b\u043e\u0433 \u0438\u043b\u0438 glob-\u043c\u0430\u0441\u043a\u0443). \u041d\u0430\u043f\u043e\u043c\u043d\u0438\u043c, [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-83061","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u043e\u0441\u043b\u0435 \u0442\u0440\u0451\u0445 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/pt\/blog\/news\/reliz-openssh-8-3-s-ustraneniem-uyazvimosti-v-scp\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"pt_PT\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0420\u0435\u043b\u0438\u0437 OpenSSH 8.3 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 scp | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u043e\u0441\u043b\u0435 \u0442\u0440\u0451\u0445 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/pt\/blog\/news\/reliz-openssh-8-3-s-ustraneniem-uyazvimosti-v-scp\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-05-27T23:42:22+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-05-27T23:42:22+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Lan\u00e7amento do OpenSSH 8.3 com corre\u00e7\u00e3o de vulnerabilidade no scp | ProHoster","description":"Ap\u00f3s tr\u00eas meses de desenvolvimento, foi lan\u00e7ado","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/news\/reliz-openssh-8-3-s-ustraneniem-uyazvimosti-v-scp","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u043b\u0438\u0437 OpenSSH 8.3 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 scp | ProHoster","og:description":"\u041f\u043e\u0441\u043b\u0435 \u0442\u0440\u0451\u0445 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437","og:url":"https:\/\/prohoster.info\/pt\/blog\/news\/reliz-openssh-8-3-s-ustraneniem-uyazvimosti-v-scp","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-05-27T23:42:22+00:00","article:modified_time":"2020-05-27T23:42:22+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"83061","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 15:25:24","updated":"2022-10-02 17:17:29","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/83061","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=83061"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/83061\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=83061"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=83061"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=83061"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}