{"id":37095,"date":"2019-10-31T22:15:43","date_gmt":"2019-10-31T19:15:43","guid":{"rendered":"https:\/\/prohoster.info\/blog\/v-razlichnyh-realizatsiyah-protokola-http-2-vyyavleno-8-dos-uyazvimostej\/"},"modified":"2019-10-31T22:15:43","modified_gmt":"2019-10-31T19:15:43","slug":"v-razlichnyh-realizatsiyah-protokola-http-2-vyyavleno-8-dos-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/v-razlichnyh-realizatsiyah-protokola-http-2-vyyavleno-8-dos-uyazvimostej","title":{"rendered":"Au fost descoperite 8 vulnerabilit\u0103\u021bi DoS \u00een diverse implement\u0103ri ale protocolului HTTP\/2","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Cercet\u0103torii de la companiile Netflix \u0219i Google <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/Netflix\/security-bulletins\/blob\/master\/advisories\/third-party\/2019-002.md\">au identificat<\/a><\/noindex>  au descoperit opt vulnerabilit\u0103\u021bi \u00een diferitele implement\u0103ri ale protocolului HTTP\/2, care permit provocarea unui atac de tip denial of service prin trimiterea unui flux de cereri de re\u021bea formatate \u00eentr-un anumit mod. Problemele afecteaz\u0103 \u00een diverse m\u0103suri majoritatea serverelor HTTP care suport\u0103 HTTP\/2 \u0219i duc la epuizarea memoriei disponibile pentru procesele de lucru sau la o \u00eenc\u0103rc\u0103tur\u0103 prea mare pe CPU. Actualiz\u0103rile care remediaz\u0103 vulnerabilit\u0103\u021bile au fost deja prezentate \u00een <noindex><a rel=\"nofollow\" href=\"http:\/\/mailman.nginx.org\/pipermail\/nginx-announce\/2019\/000247.html\">nginx 1.16.1\/1.17.3<\/a><\/noindex> \u0219i <noindex><a rel=\"nofollow\" href=\"http:\/\/blog.kazuhooku.com\/2019\/08\/h2o-version-226-230-beta2-released.html\">H2O 2.2.6<\/a><\/noindex>, dar p\u00e2n\u0103 acum <noindex><a rel=\"nofollow\" href=\"http:\/\/www.apache.org\/dist\/httpd\/\">inaccessible<\/a><\/noindex> pentru Apache httpd \u0219i <noindex><a rel=\"nofollow\" href=\"https:\/\/www.kb.cert.org\/vuls\/id\/605641\/\">alte produse<\/a><\/noindex>.<\/p>\n<p>Problemele au fost cauzate de complexit\u0103\u021bile introduse \u00een protocolul HTTP\/2, legate de utilizarea structurilor binare, sistemul de limitare a fluxurilor de date \u00een cadrul conexiunilor, mecanismul de priorizare a fluxurilor \u0219i existen\u021ba mesajelor de control asem\u0103n\u0103toare ICMP, care func\u021bioneaz\u0103 la nivelul conexiunii HTTP\/2 (de exemplu, opera\u021biunile ping, resetarea \u0219i configurarea fluxului). Multe implement\u0103ri nu au limitat corespunz\u0103tor fluxul mesajelor de control, au organizat ineficient func\u021bionarea cozii de priorit\u0103\u021bi la procesarea cererilor sau au folosit implement\u0103ri suboptime ale algoritmului de control al fluxului.<\/p>\n<p>Cele mai multe dintre metodele de atac identificate se reduc la trimiterea c\u0103tre server a unor cereri specifice, care duc la generarea unui num\u0103r mare de r\u0103spunsuri. Dac\u0103 clientul nu cite\u0219te datele din socket \u0219i nu \u00eentrerupe conexiunea, coada de bufferizare a r\u0103spunsurilor de pe partea serverului se umple continuu. Un astfel de comportament genereaz\u0103 o sarcin\u0103 pe sistemul de gestionare a cozii de procesare a conexiunilor de re\u021bea \u0219i, \u00een func\u021bie de particularit\u0103\u021bile implement\u0103rii, duce la epuizarea memoriei disponibile sau a resurselor CPU.<\/p>\n<p>Vulnerabilit\u0103\u021bile identificate:<\/p>\n<ul>\n<li class=\"l\"> CVE-2019-9511 (Data Dribble) \u2014 un atacator solicit\u0103 un volum mare de date \u00een mai multe fluxuri, manipul\u00e2nd dimensiunea feronetei \u0219i prioritatea fluxului, for\u021b\u00e2nd serverul s\u0103 plaseze datele \u00een coad\u0103 \u00een blocuri de c\u00e2te 1 byte;\n<li class=\"l\">  CVE-2019-9512 (Ping Flood) \u2014 un atacator trimite continuu mesaje ping printr-o conexiune HTTP\/2, ini\u021biind umplerea cozii interne de r\u0103spunsuri de cealalt\u0103 parte;\n<li class=\"l\"> CVE-2019-9513 (Resource Loop) \u2014 un atacator creeaz\u0103 mai multe fluxuri de cereri \u0219i schimb\u0103 continuu prioritatea fluxurilor, provoc\u00e2nd amestecarea arborelui de priorit\u0103\u021bi;\n<li class=\"l\"> CVE-2019-9514 (Reset Flood) \u2014 un atacator creeaz\u0103 mai multe fluxuri<br \/>\n \u0219i trimite prin fiecare flux o cerere incorect\u0103, provoc\u00e2nd trimiterea de c\u0103tre server a cadrelor RST_STREAM, dar nu le accept\u0103 pentru umplerea cozii de r\u0103spunsuri;<\/p>\n<li class=\"l\"> CVE-2019-9515 (Settings Flood) \u2014 un atacator trimite un flux de cadre goale \u201eSETTINGS\u201d, la care serverul trebuie s\u0103 confirme primirea fiec\u0103rei cereri;\n<li class=\"l\">  CVE-2019-9516 (0-Length Headers Leak) \u2014 un atacator trimite un flux de antete cu nume zero \u0219i valoare zero, iar serverul aloc\u0103 un buffer \u00een memorie pentru a stoca fiecare antet \u0219i nu \u00eel elibereaz\u0103 p\u00e2n\u0103 la \u00eencheierea sesiunii;\n<li class=\"l\">   CVE-2019-9517 (Internal Data Buffering) \u2014 un atacator deschide<br \/>\nfereastra glisant\u0103 HTTP\/2 pentru a trimite date de c\u0103tre server f\u0103r\u0103 restric\u021bii, dar men\u021bine fereastra TCP \u00eenchis\u0103, ceea ce nu permite efectiv scrierea datelor \u00een socket. Apoi, atacatorul trimite cereri care necesit\u0103 un r\u0103spuns mare;<\/p>\n<li class=\"l\"> CVE-2019-9518 (Empty Frames Flood) \u2014 un atacator trimite un flux de cadre de tip DATA, HEADERS, CONTINUATION sau PUSH_PROMISE, dar cu un con\u021binut util gol \u0219i f\u0103r\u0103 flag de \u00eencheiere a fluxului. Serverul pierde timp proces\u00e2nd fiecare cadru, dispropor\u021bionat fa\u021b\u0103 de banda de l\u0103\u021bime utilizat\u0103 de atacator.\n<\/ul>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Sursa: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=51279\">opennet.ro<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 Netflix \u0438 Google \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 HTTP\/2 \u0432\u043e\u0441\u0435\u043c\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438 \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u044b\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u043f\u043e\u0442\u043e\u043a\u0430 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0432 \u0442\u043e\u0439 \u0438\u043b\u0438 \u0438\u043d\u043e\u0439 \u043c\u0435\u0440\u0435 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0442 \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0441 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u043e\u0439 HTTP\/2 \u0438 \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0442 \u043a \u0438\u0441\u0447\u0435\u0440\u043f\u0430\u043d\u0438\u044e \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0439 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0447\u0435\u0433\u043e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430 \u043f\u0430\u043c\u044f\u0442\u0438 \u0438\u043b\u0438 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044e \u0441\u043b\u0438\u0448\u043a\u043e\u043c \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043d\u0430 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-37095","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 Netflix \u0438 Google \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/news\/v-razlichnyh-realizatsiyah-protokola-http-2-vyyavleno-8-dos-uyazvimostej\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 HTTP\/2 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 8 DoS-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 Netflix \u0438 Google \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/news\/v-razlichnyh-realizatsiyah-protokola-http-2-vyyavleno-8-dos-uyazvimostej\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:15:43+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:15:43+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47\u00cen diverse implement\u0103ri ale protocolului HTTP\/2 au fost descoperite 8 vulnerabilit\u0103\u021bi DoS | ProHoster","description":"Cercet\u0103torii de la companiile Netflix \u0219i Google au identificat \u00een diverse implement\u0103ri.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/v-razlichnyh-realizatsiyah-protokola-http-2-vyyavleno-8-dos-uyazvimostej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 HTTP\/2 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 8 DoS-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 Netflix \u0438 Google \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/v-razlichnyh-realizatsiyah-protokola-http-2-vyyavleno-8-dos-uyazvimostej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:15:43+00:00","article:modified_time":"2019-10-31T19:15:43+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"37095","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 06:06:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 23:22:07","updated":"2026-01-22 06:06:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/37095","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=37095"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/37095\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=37095"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=37095"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=37095"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}