Compania Qualys a identificat o vulnerabilitate critic\u0103 (CVE-2024-6387) \u00een OpenSSH, care permite executarea de cod de la distan\u021b\u0103 cu drepturi de root f\u0103r\u0103 autentificare. Vulnerabilitatea, cunoscut\u0103 sub numele de regreSSHion, se manifest\u0103 \u00een configura\u021bia implicit\u0103 \u00eencep\u00e2nd cu versiunea OpenSSH 8.5 pe sistemele cu biblioteca standard Glibc. <\/p>\n
Posibilitatea de a efectua un atac a fost demonstrat\u0103 pe un sistem de 32 de bi\u021bi cu Glibc cu protec\u021bia ASLR (randomizarea spa\u021biului de adresare) activat\u0103. Pentru un atac de succes \u00een condi\u021bii de laborator, a fost necesar\u0103 o perioad\u0103 de 6-8 ore, timp \u00een care s serverul<\/a> au stabilit continuu conexiuni cu intensitatea maxim\u0103 permis\u0103 \u00een configura\u021bia sshd. Efectuarea atacului este simplificat\u0103 \u0219i necesit\u0103 mai pu\u021bin timp pe sistemele f\u0103r\u0103 ASLR sau \u00een distribuitivele care folosesc OpenSSH modificat, \u00een care re-randomizarea ASLR a fost dezactivat\u0103 pentru fiecare conexiune. Prototipul func\u021bional al exploit-ului nu va fi publicat public p\u00e2n\u0103 la eliminarea generalizat\u0103 a vulnerabilit\u0103\u021bii, dar este disponibil un document suficient de detaliat care descrie natura vulnerabilit\u0103\u021bii, ceea ce face ca apari\u021bia exploit-urilor externe s\u0103 fie o chestiune de timp.<\/p>\n Nu este exclus\u0103 posibilitatea efectu\u0103rii atacului \u0219i pe sistemele de 64 de bi\u021bi, dar un exploit func\u021bional pentru aceste sisteme nu este \u00eenc\u0103 disponibil. Se presupune c\u0103 efectuarea unui atac asupra sistemelor de 64 de bi\u021bi va dura mult mai mult, dar nu mai mult de o s\u0103pt\u0103m\u00e2n\u0103. OpenSSH \u00een OpenBSD nu este vulnerabil, deoarece \u00een acest sistem din 2001 este aplicat un mecanism de protec\u021bie care blocheaz\u0103 astfel de clase de atacuri. \u00cen alte sisteme bazate pe biblioteci standard, diferite de Glibc, teoretic este posibil\u0103 adaptarea metodei pentru a efectua un atac (partea aceasta nu a fost \u00eenc\u0103 cercetat\u0103 de c\u0103tre Qualys). <\/p>\n Vulnerabilitatea a fost eliminat\u0103 \u00een versiunea publicat\u0103 ast\u0103zi a OpenSSH 9.8 (patch). Actualiz\u0103rile pachetelor pot fi urm\u0103rite pe paginile: Debian, Ubuntu, RHEL, SUSE\/openSUSE, Fedora, ROSA, Gentoo, ALT Linux, Arch \u0219i FreeBSD. Ca o solu\u021bie temporar\u0103 pentru blocarea vulnerabilit\u0103\u021bii, \u00een sshd_config se poate seta parametrul «LoginGraceTime=0», totu\u0219i dezactivarea timeout-ului va simplifica ini\u021bierea unui atac de refuz de serviciu prin stabilirea unui num\u0103r mare de conexiuni care dep\u0103\u0219esc limitele stabilite prin parametrul MaxStartups. Vulnerabilitatea a ap\u0103rut ca urmare a unei modific\u0103ri regresive incluse \u00een versiunea OpenSSH 8.5, care conduce la o stare de competi\u021bie \u00een codul de gestionare a semnalelor \u00een sshd. Regresia a dus la pierderea protec\u021biei \u00eempotriva unei vechi vulnerabilit\u0103\u021bi CVE-2006-5051, care se manifesta p\u00e2n\u0103 la versiunea OpenSSH 4.4 (anul 2006) \u0219i avea caracter teoretic. Gestiunea SIGALRM este apelat\u0103 \u00een sshd \u00een mod asincron, dac\u0103 clientul nu s-a autentificat \u00een intervalul de timp limitat de timeout-ul de conectare (LoginGraceTime, implicit 120 sec). Atacul se bazeaz\u0103 pe faptul c\u0103 gestiunea semnalului apeleaz\u0103 func\u021bii nesigure \u00een timpul gestion\u0103rii asincrone a semnalelor, precum syslog(). Func\u021bia syslog() din Glibc nu este proiectat\u0103 pentru utilizare \u00een gestiuni de semnale executate asincron, deoarece apeleaz\u0103 func\u021bii malloc() \u0219i free(). Activarea semnalului SIGALRM, care \u00eentrerupe execu\u021bia unui anumit cod \u00een sshd, poate duce la o perturbare a st\u0103rii de execu\u021bie, iar scopul exploit-ului este de a crea condi\u021bii pentru a \u00eentrerupe codul necesar \u00een momentul corespunz\u0103tor al execu\u021biei sale. Vulnerabilitatea nu afecteaz\u0103 OpenBSD, deoarece acolo, \u00een loc de syslog() din gestiunea semnalului SIGALRM, se apeleaz\u0103 func\u021bia syslog_r(), creat\u0103 special pentru execu\u021bia asincron\u0103. \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Qualys \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-6387) \u0432 OpenSSH, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root \u0431\u0435\u0437 \u043f\u0440\u043e\u0445\u043e\u0436\u0434\u0435\u043d\u0438\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f regreSSHion, \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u0435\u0440\u0441\u0438\u0438 OpenSSH 8.5 \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0441\u043e \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u043e\u0439 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u043e\u0439 Glibc. \u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u043d\u0430 32-\u0440\u0430\u0437\u0440\u044f\u0434\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0441 Glibc \u0441 \u0432\u043a\u043b\u044e\u0447\u0451\u043d\u043d\u043e\u0439 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 ASLR (\u0440\u0430\u043d\u0434\u043e\u043c\u0438\u0437\u0430\u0446\u0438\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-116883","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilitate \u00een OpenSSH care permite executarea de cod de la distan\u021b\u0103 cu privilegii root pe servere cu Glibc | ProHoster","description":"Compania Qualys a identificat o vulnerabilitate critic\u0103 (CVE-2024-6387) \u00een OpenSSH, care permite executarea de cod de la distan\u021b\u0103 cu privilegii root f\u0103r\u0103 autentificare.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-openssh-pozvolyayushhaya-udalyonno-vypolnit-kod-s-pravami-root-na-serverah-s-glibc","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 OpenSSH, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 \u0441 Glibc | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Qualys \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-6387) \u0432 OpenSSH, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root \u0431\u0435\u0437 \u043f\u0440\u043e\u0445\u043e\u0436\u0434\u0435\u043d\u0438\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-openssh-pozvolyayushhaya-udalyonno-vypolnit-kod-s-pravami-root-na-serverah-s-glibc","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-07-01T16:05:44+00:00","article:modified_time":"2024-07-01T16:05:44+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"116883","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 21:59:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 03:18:19","updated":"2026-02-09 21:59:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/116883","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=116883"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/116883\/revisions"}],"predecessor-version":[{"id":160364,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/116883\/revisions\/160364"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=116883"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=116883"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=116883"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\nUnul dintre semnele tentativelor de atac este apari\u021bia \u00eentr-un jurnal a unui num\u0103r mare de \u00eenregistr\u0103ri «Timeout before authentication».<\/p>\n
\n\u00cen timpul dezvolt\u0103rii OpenSSH 8.5, din gre\u0219eal\u0103, blocul «#ifdef DO_LOG_SAFE_IN_SIGHAND» a fost eliminat din func\u021bia sigdie(), care este apelat\u0103 direct din handlerul SIGALRM.<\/p>\n
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"