{"id":87197,"date":"2020-07-05T07:42:02","date_gmt":"2020-07-05T05:42:02","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-ssh-klientah-openssh-i-putty"},"modified":"2020-07-05T07:42:02","modified_gmt":"2020-07-05T05:42:02","slug":"uyazvimost-v-ssh-klientah-openssh-i-putty","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-ssh-klientah-openssh-i-putty","title":{"rendered":"Vulnerabilitate \u00een clien\u021bii SSH OpenSSH \u0219i PuTTY","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\u00cen clien\u021bii SSH OpenSSH \u0219i PuTTY a fost identificat\u0103<\/a><\/noindex> vulnerabilitatea<\/a><\/noindex> (CVE-2020-14002<\/a><\/noindex> \u00een PuTTY \u0219i CVE-2020-14145<\/a><\/noindex> \u00een OpenSSH), care duce la scurgerea informa\u021biilor \u00een algoritmul de negociere a conexiunii. Vulnerabilitatea permite unui atacator, capabil s\u0103 intercepteze traficul clientului (de exemplu, atunci c\u00e2nd utilizatorul se conecteaz\u0103 printr-un punct de acces wireless controlat de atacator), s\u0103 determine \u00eencercarea ini\u021bial\u0103 de conectare a clientului la gazd\u0103, atunci c\u00e2nd clientul nu a stocat \u00eenc\u0103 cheia gazdei. <\/p>\n

\u0218tiind c\u0103 clientul \u00eencearc\u0103 s\u0103 se conecteze pentru prima dat\u0103 \u0219i nu are deja cheia gazdei, atacatorul poate transce comunica\u021bia prin el (MITM) \u0219i poate prezenta clientului cheia sa de gazd\u0103, pe care clientul SSH o va considera cheia gazdei \u021bint\u0103, dac\u0103 nu va verifica amprenta cheii. Astfel, atacatorul poate organiza un MITM f\u0103r\u0103 s\u0103 ridice suspiciuni la utilizator \u0219i poate ignora sesiunile \u00een care clientul are deja chei gazde stocate \u00een cache, \u00eencercarea de manipulare a c\u0103rora va duce la emiterea unui avertisment despre schimbarea cheii gazdei. Atacul se bazeaz\u0103 pe neglijen\u021ba utilizatorilor care nu efectueaz\u0103 verificarea manual\u0103 a amprentei cheii gazdei la prima conectare. Cei care verific\u0103 amprentele cheilor sunt proteja\u021bi de astfel de atacuri.<\/p>\n

Ca semn pentru a determina prima \u00eencercare de conectare, se folose\u0219te modificarea ordinii enumer\u0103rii algoritmilor de chei gazd\u0103 accepta\u021bi. \u00cen cazul \u00een care are loc prima conectare, clientul transmite o list\u0103 de algoritmi implicit\u0103, iar dac\u0103 cheia gazdei este deja \u00een cache, algoritmul asociat este plasat pe prima pozi\u021bie (algoritmii sunt sorta\u021bi \u00een ordinea preferin\u021bei). <\/p>\n

Problema se manifest\u0103 \u00een versiunile OpenSSH de la 5.7 la 8.3 \u0219i \u00een PuTTY de la 0.68 la 0.73. Problema remediat\u0103<\/a><\/noindex> \u00een versiunea PuTTY 0.74<\/a><\/noindex> prin ad\u0103ugarea unei op\u021biuni pentru a dezactiva construirea dinamic\u0103 a listei algoritmilor de procesare a cheilor gazd\u0103 \u00een favoarea enumer\u0103rii algoritmilor \u00eentr-o ordine fix\u0103.<\/p>\n

Proiectul OpenSSH nu inten\u021bioneaz\u0103 s\u0103 schimbe comportamentul clientului SSH, deoarece, dac\u0103 algoritmul cheii existente nu este specificat primul, va fi aplicat\u0103 o \u00eencercare de utilizare a unui algoritm care nu corespunde cheii cache-uite, cu o avertizare despre cheia necunoscut\u0103. Cu alte cuvinte, apare o alegere \u2014 fie o scurgere de informa\u021bii (OpenSSH \u0219i PuTTY), fie afi\u0219area de avertiz\u0103ri despre schimbarea cheii (Dropbear SSH) \u00een cazul \u00een care cheia salvat\u0103 nu corespunde primului algoritm din lista implicit\u0103.<\/p>\n

Pentru a asigura protec\u021bia, OpenSSH propune utilizarea unor metode alternative de verificare a cheii gazdelor prin intermediul \u00eenregistr\u0103rilor SSHFP \u00een DNSSEC \u0219i a certificatelor gazdelor (PKI). De asemenea, se poate dezactiva selec\u021bia adaptiv\u0103 a algoritmilor cheilor gazdelor prin op\u021biunea HostKeyAlgorithms \u0219i se poate utiliza op\u021biunea UpdateHostKeys pentru a ob\u021bine chei gazde suplimentare dup\u0103 autentificare.<\/p>\n

<\/a><\/noindex><\/p>\n

Sursa: opennet.ro<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 SSH-\u043a\u043b\u0438\u0435\u043d\u0442\u0430\u0445 OpenSSH \u0438 PuTTY \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2020-14002 \u0432 PuTTY \u0438 CVE-2020-14145 \u0432 OpenSSH), \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u0443\u0442\u0435\u0447\u043a\u0435 \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u0439 \u0432 \u0430\u043b\u0433\u043e\u0440\u0438\u0442\u043c\u0435 \u0441\u043e\u0433\u043b\u0430\u0441\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443, \u0441\u043f\u043e\u0441\u043e\u0431\u043d\u043e\u043c\u0443 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0438\u0442\u044c \u0442\u0440\u0430\u0444\u0438\u043a \u043a\u043b\u0438\u0435\u043d\u0442\u0430 (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043f\u0440\u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0447\u0435\u0440\u0435\u0437 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u0443\u044e \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u043c \u0442\u043e\u0447\u043a\u0443 \u0431\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430), \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u043f\u043e\u043f\u044b\u0442\u043a\u0443 \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u043a \u0445\u043e\u0441\u0442\u0443, \u043a\u043e\u0433\u0434\u0430 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u043c \u0435\u0449\u0451 \u043d\u0435 \u043f\u0440\u043e\u043a\u044d\u0448\u0438\u0440\u043e\u0432\u0430\u043d \u043a\u043b\u044e\u0447 \u0445\u043e\u0441\u0442\u0430. \u0417\u043d\u0430\u044f, \u0447\u0442\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-87197","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilitate \u00een clien\u021bii SSH OpenSSH \u0219i PuTTY | ProHoster","description":"\u00cen clien\u021bii SSH OpenSSH \u0219i PuTTY","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-ssh-klientah-openssh-i-putty","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 SSH-\u043a\u043b\u0438\u0435\u043d\u0442\u0430\u0445 OpenSSH \u0438 PuTTY | ProHoster","og:description":"\u0412 SSH-\u043a\u043b\u0438\u0435\u043d\u0442\u0430\u0445 OpenSSH \u0438 PuTTY","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-ssh-klientah-openssh-i-putty","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-07-05T05:42:02+00:00","article:modified_time":"2020-07-05T05:42:02+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"87197","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 13:56:23","updated":"2022-10-07 22:11:57","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/87197","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=87197"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/87197\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=87197"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=87197"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=87197"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}