{"id":83061,"date":"2020-05-28T01:42:22","date_gmt":"2020-05-27T23:42:22","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/reliz-openssh-8-3-s-ustraneniem-uyazvimosti-v-scp"},"modified":"2020-05-28T01:42:22","modified_gmt":"2020-05-27T23:42:22","slug":"reliz-openssh-8-3-s-ustraneniem-uyazvimosti-v-scp","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/reliz-openssh-8-3-s-ustraneniem-uyazvimosti-v-scp","title":{"rendered":"Lansarea OpenSSH 8.3 cu remedieri pentru vulnerabilitatea \u00een scp.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Dup\u0103 trei luni de dezvoltare <noindex><a rel=\"nofollow\" href=\"https:\/\/lists.mindrot.org\/pipermail\/openssh-unix-dev\/2020-May\/038528.html\">la sf\u00e2r\u0219itul anului 2019. Pe l\u00e2ng\u0103 protocoalele ActivityPub \u0219i diaspora, Hubzilla se federeaz\u0103 \u00een cadrul re\u021belei prin propriul s\u0103u protocol<\/a><\/noindex> lansare <noindex><a rel=\"nofollow\" href=\"https:\/\/www.openssh.com\/\">OpenSSH 8.3<\/a><\/noindex>, o implementare deschis\u0103 a clientului \u0219i serverului pentru func\u021bionarea pe protocoalele SSH 2.0 \u0219i SFTP. <\/p>\n<p>Noua versiune introduce protec\u021bie \u00eempotriva atacurilor asupra scp, permi\u021b\u00e2nd serverului s\u0103 transmit\u0103 alte nume de fi\u0219iere, diferite de cele solicitate (spre deosebire de <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=49953\">vulnerabilitatea anterioar\u0103<\/a><\/noindex>, atacul nu permite schimbarea directorului ales de utilizator sau a m\u0103\u0219tii glob). Amintim c\u0103 \u00een SCP serverul decide ce fi\u0219iere \u0219i directoare s\u0103 trimit\u0103 clientului, iar clientul doar verific\u0103 corectitudinea numelui obiectelor returnate. Esen\u021ba problemei identificate este c\u0103, dac\u0103 apelul sistemului utimes e\u0219ueaz\u0103, con\u021binutul fi\u0219ierului este interpretat ca metadate ale fi\u0219ierului. <\/p>\n<p>Aceast\u0103 caracteristic\u0103, atunci c\u00e2nd se conecteaz\u0103 la un server controlat de un atacator, poate fi folosit\u0103 pentru a salva \u00een sistemul de fi\u0219iere al utilizatorului alte nume de fi\u0219iere \u0219i con\u021binut diferit atunci c\u00e2nd se face copiere prin scp \u00een configura\u021bii care determin\u0103 e\u0219ecul apelului utimes (de exemplu, \u00een cazul \u00een care utimes este interzis de politica SELinux sau de un filtru de apeluri sistem). Probabilitatea de a efectua atacuri reale este considerat\u0103 minim\u0103, deoarece \u00een configura\u021biile tipice apelul utimes nu e\u0219ueaz\u0103. \u00cen plus, atacul nu trece neobservat - la apelul scp apare o eroare de transfer de date.<\/p>\n<p>Modific\u0103ri generale:<\/p>\n<ul>\n<li class=\"l\"> \u00cen sftp, procesarea argumentului \u201e-1\u201d a fost oprit\u0103, similar cu ssh \u0219i scp, care anterior era acceptat, dar ignorat;\n<li class=\"l\"> \u00cen sshd, utilizarea IgnoreRhosts ofer\u0103 acum trei op\u021biuni: \u201eyes\u201d - a ignora rhosts\/shosts, \u201eno\u201d - a lua \u00een considerare rhosts\/shosts \u0219i \u201eshosts-only\u201d - a permite \u201e.shosts\u201d, dar a interzice \u201e.rhosts\u201d;\n<li class=\"l\"> \u00cen ssh este asigurat\u0103 prelucrarea substitu\u021biei %TOKEN \u00een set\u0103rile LocalForward \u0219i RemoteForward, folosite pentru redirec\u021bionarea Unix-socketurilor;\n<li class=\"l\"> Este permis\u0103 \u00eenc\u0103rcarea cheilor publice dintr-un fi\u0219ier necriptat cu cheia privat\u0103, dac\u0103 nu exist\u0103 un fi\u0219ier separat cu cheia public\u0103;\n<li class=\"l\"> Dac\u0103 \u00een sistem se afl\u0103 libcrypto, ssh \u0219i sshd folosesc acum implementarea algoritmului chacha20 din aceast\u0103 bibliotec\u0103, \u00een loc de implementarea portabil\u0103 \u00eencorporat\u0103, care este mai pu\u021bin performant\u0103;\n<li class=\"l\"> A fost implementat\u0103 posibilitatea de a face dump-ul con\u021binutului listei binare de certificate revocate atunci c\u00e2nd se execut\u0103 comanda \u201essh-keygen -lQf \/path\u201d;\n<li class=\"l\"> \u00cen versiunea portabil\u0103 a fost implementat\u0103 determinarea sistemelor \u00een care semnalele cu op\u021biunea SA_RESTART \u00eentrerup execu\u021bia select;\n<li class=\"l\"> Au fost rezolvate problemele de compilare \u00een sistemele HP\/UX \u0219i AIX;\n<li class=\"l\"> Problemele legate de compilarea seccomp sandbox \u00een anumite configura\u021bii Linux au fost remediate;\n<li class=\"l\"> A fost \u00eembun\u0103t\u0103\u021bit\u0103 detectarea bibliotecii libfido2 \u0219i au fost rezolvate problemele de compilare cu op\u021biunea \u201e--with-security-key-builtin\u201d.\n<\/ul>\n<p>Dezvoltatorii OpenSSH au avertizat din nou c\u0103 algoritmii care folosesc hashuri SHA-1 vor fi clasifica\u021bi ca \u00eenvechi\u021bi, din cauza <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=52149\">cre\u0219terea<\/a><\/noindex> eficien\u021ba atacurilor de coliziune cu un prefix dat (costul determin\u0103rii unei coliziuni este estimat la aproximativ 45.000 de dolari). \u00cen una dintre urm\u0103toarele versiuni, se preconizeaz\u0103 dezactivarea, implicit, a utiliz\u0103rii algoritmului de semn\u0103tur\u0103 digital\u0103 bazat pe cheie public\u0103 \u201essh-rsa\u201d, men\u021bionat \u00een RFC original pentru protocolul SSH \u0219i care r\u0103m\u00e2ne pe scar\u0103 larg\u0103 folosit \u00een practic\u0103 (pentru a verifica utilizarea ssh-rsa \u00een sistemele proprii, se poate \u00eencerca conectarea prin ssh cu op\u021biunea \u201e-oHostKeyAlgorithms=-ssh-rsa\u201d).<\/p>\n<p>Pentru a facilita tranzi\u021bia c\u0103tre noile algoritmi \u00een OpenSSH, \u00eentr-una dintre urm\u0103toarele versiuni va fi activat\u0103 \u00een mod implicit setarea UpdateHostKeys, care va permite clien\u021bilor s\u0103 fie transfera\u021bi automat la algoritmi mai siguri. Printre algoritmii recomanda\u021bi pentru migrare se num\u0103r\u0103 rsa-sha2-256\/512 bazat pe RFC8332 RSA SHA-2 (sus\u021binut din OpenSSH 7.2 \u0219i utilizat implicit), ssh-ed25519 (sus\u021binut din OpenSSH 6.5) \u0219i ecdsa-sha2-nistp256\/384\/521 bazat pe RFC5656 ECDSA (sus\u021binut din OpenSSH 5.7). <\/p>\n<p>\u00cencep\u00e2nd cu ultima versiune, \u201essh-rsa\u201d \u0219i \u201ediffie-hellman-group14-sha1\u201d au fost eliminate din lista CASignatureAlgorithms, care define\u0219te algoritmii permisi pentru semnarea digital\u0103 a noilor certificate, deoarece utilizarea SHA-1 \u00een certificate implic\u0103 un risc suplimentar datorit\u0103 faptului c\u0103 atacatorul are timp nelimitat pentru a c\u0103uta o coliziune pentru un certificat existent, \u00een timp ce timpul de atac asupra cheilor gazdelor este limitat de timpul de a\u0219teptare al conexiunii (LoginGraceTime). <\/p>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Sursa: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=53039\">opennet.ro<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u043e\u0441\u043b\u0435 \u0442\u0440\u0451\u0445 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 OpenSSH 8.3, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430\u043c SSH 2.0 \u0438 SFTP. \u0412 \u043d\u043e\u0432\u043e\u043c \u0432\u044b\u043f\u0443\u0441\u043a\u0435 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0430 \u0437\u0430\u0449\u0438\u0442\u0430 \u043e\u0442 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 scp, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0441\u0435\u0440\u0432\u0435\u0440\u0443 \u043f\u0435\u0440\u0435\u0434\u0430\u0442\u044c \u0434\u0440\u0443\u0433\u0438\u0435 \u0438\u043c\u0435\u043d\u0430 \u0444\u0430\u0439\u043b\u043e\u0432, \u043e\u0442\u043b\u0438\u0447\u0430\u044e\u0449\u0438\u0435\u0441\u044f \u043e\u0442 \u0437\u0430\u043f\u0440\u043e\u0448\u0435\u043d\u043d\u044b\u0445 (\u0432 \u043e\u0442\u043b\u0438\u0447\u0438\u0435 \u043e\u0442 \u043f\u0440\u043e\u0448\u043b\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0430\u0442\u0430\u043a\u0430 \u043d\u0435 \u0434\u0430\u0451\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0441\u043c\u0435\u043d\u0438\u0442\u044c \u0432\u044b\u0431\u0440\u0430\u043d\u043d\u044b\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c \u043a\u0430\u0442\u0430\u043b\u043e\u0433 \u0438\u043b\u0438 glob-\u043c\u0430\u0441\u043a\u0443). \u041d\u0430\u043f\u043e\u043c\u043d\u0438\u043c, [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-83061","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u043e\u0441\u043b\u0435 \u0442\u0440\u0451\u0445 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/news\/reliz-openssh-8-3-s-ustraneniem-uyazvimosti-v-scp\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0420\u0435\u043b\u0438\u0437 OpenSSH 8.3 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 scp | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u043e\u0441\u043b\u0435 \u0442\u0440\u0451\u0445 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/news\/reliz-openssh-8-3-s-ustraneniem-uyazvimosti-v-scp\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-05-27T23:42:22+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-05-27T23:42:22+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Lansare OpenSSH 8.3 cu remedieri pentru vulnerabilitatea din scp | ProHoster","description":"Dup\u0103 trei luni de dezvoltare, a fost lansat\u0103 versiunea","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/reliz-openssh-8-3-s-ustraneniem-uyazvimosti-v-scp","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u043b\u0438\u0437 OpenSSH 8.3 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 scp | ProHoster","og:description":"\u041f\u043e\u0441\u043b\u0435 \u0442\u0440\u0451\u0445 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/reliz-openssh-8-3-s-ustraneniem-uyazvimosti-v-scp","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-05-27T23:42:22+00:00","article:modified_time":"2020-05-27T23:42:22+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"83061","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 15:25:24","updated":"2022-10-02 17:17:29","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/83061","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=83061"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/83061\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=83061"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=83061"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=83061"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}