{"id":87197,"date":"2020-07-05T07:42:02","date_gmt":"2020-07-05T05:42:02","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-ssh-klientah-openssh-i-putty"},"modified":"2020-07-05T07:42:02","modified_gmt":"2020-07-05T05:42:02","slug":"uyazvimost-v-ssh-klientah-openssh-i-putty","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimost-v-ssh-klientah-openssh-i-putty","title":{"rendered":"Zranite\u013enos\u0165 v SSH klientoch OpenSSH a PuTTY","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V SSH klientoch OpenSSH a PuTTY bola zisten\u00e1<\/a><\/noindex> zranite\u013enos\u0165<\/a><\/noindex> (CVE-2020-14002<\/a><\/noindex> v PuTTY a CVE-2020-14145<\/a><\/noindex> v OpenSSH), \u010do vedie k \u00faniku inform\u00e1ci\u00ed v algoritme zhodovania pripojenia. Zranite\u013enos\u0165 umo\u017e\u0148uje \u00fato\u010dn\u00edkovi, ktor\u00fd dok\u00e1\u017ee odchyt\u00e1va\u0165 prenos klienta (napr\u00edklad pri pripojen\u00ed pou\u017e\u00edvate\u013ea cez kontrolovan\u00fd \u00fato\u010dn\u00edkom bezdr\u00f4tov\u00fd pr\u00edstupov\u00fd bod), ur\u010di\u0165 pokus prvotn\u00e9ho pripojenia klienta k hostite\u013eovi, ke\u010f klient e\u0161te nem\u00e1 v cache k\u013e\u00fa\u010d hostite\u013ea. <\/p>\n

Ved\u00fac na to, \u017ee klient sa pok\u00fa\u0161a pripoji\u0165 prv\u00fdkr\u00e1t a e\u0161te nem\u00e1 na svojej strane k\u013e\u00fa\u010d hostite\u013ea, m\u00f4\u017ee \u00fato\u010dn\u00edk retransmitova\u0165 spojenie cez seba (MITM) a predstavi\u0165 klientovi svoj hostite\u013esk\u00fd k\u013e\u00fa\u010d, ktor\u00fd SSH klient pova\u017euje za k\u013e\u00fa\u010d cie\u013eov\u00e9ho hostite\u013ea, ak nevykon\u00e1 overenie otla\u010dku k\u013e\u00fa\u010da. \u00dato\u010dn\u00edk tak m\u00f4\u017ee zrealizova\u0165 MITM bez vzbudenia podozrenia u pou\u017e\u00edvate\u013ea a ignorova\u0165 rel\u00e1cie, v ktor\u00fdch m\u00e1 klient u\u017e ulo\u017een\u00e9 k\u013e\u00fa\u010de hostite\u013eov, pokus o ich fal\u0161ovanie by viedol k v\u00fdstupu upozornenia na zmenu k\u013e\u00fa\u010da hostite\u013ea. \u00datok sa zaklad\u00e1 na nezodpovednosti pou\u017e\u00edvate\u013eov, ktor\u00ed nevykon\u00e1vaj\u00fa ru\u010dn\u00e9 overenie otla\u010dku k\u013e\u00fa\u010da hostite\u013ea pri prvom pripojen\u00ed. T\u00ed, ktor\u00ed overuj\u00fa otla\u010dky k\u013e\u00fa\u010dov s\u00fa chr\u00e1nen\u00ed pred tak\u00fdmito \u00fatokmi.<\/p>\n

Ako znak na ur\u010denie prvej pokusy o pripojenie sa pou\u017e\u00edva zmena poradia uvedenia podporovan\u00fdch algoritmov hostite\u013esk\u00fdch k\u013e\u00fa\u010dov. V pr\u00edpade, \u017ee sa uskuto\u010dn\u00ed prv\u00e9 pripojenie, klient odosiela predvolen\u00fd zoznam algoritmov, a ak u\u017e je k\u013e\u00fa\u010d hostite\u013ea v cache, s\u00favisiaci algoritmus je umiestnen\u00fd na prvom mieste (algoritmy s\u00fa zoraden\u00e9 pod\u013ea preferencie). <\/p>\n

Probl\u00e9m sa prejavuje v verzi\u00e1ch OpenSSH od 5.7 do 8.3 a v PuTTY od 0.68 do 0.73. Probl\u00e9m bola odstr\u00e1nen\u00e1<\/a><\/noindex> v vydan\u00ed PuTTY 0.74<\/a><\/noindex> pridan\u00edm mo\u017enosti na vypnutie dynamick\u00e9ho vytv\u00e1rania zoznamu algoritmov spracovania hostite\u013esk\u00fdch k\u013e\u00fa\u010dov v prospech uv\u00e1dzania algoritmov v pevnom porad\u00ed.<\/p>\n

Projekt OpenSSH nepl\u00e1nuje zmeni\u0165 spr\u00e1vanie SSH klienta, preto\u017ee ak nie je zadan\u00fd algoritmus existuj\u00faceho k\u013e\u00fa\u010da na prvom mieste, bude sa pok\u00fa\u0161a\u0165 aplikova\u0165 nezodpovedaj\u00faci predcacheovan\u00fd k\u013e\u00fa\u010d algoritmu s v\u00fdstupom upozornenia o nezn\u00e1mom k\u013e\u00fa\u010di. T.j. vznik\u00e1 vo\u013eba \u2014 bu\u010f \u00fanik inform\u00e1ci\u00ed (OpenSSH a PuTTY), alebo v\u00fdstup upozornen\u00ed o zmene k\u013e\u00fa\u010da (Dropbear SSH) v pr\u00edpade, ak ulo\u017een\u00fd k\u013e\u00fa\u010d nezodpoved\u00e1 prv\u00e9mu algoritmu v predvolenom zozname.<\/p>\n

Na zabezpe\u010denie ochrany v OpenSSH sa odpor\u00fa\u010da pou\u017e\u00edva\u0165 alternat\u00edvne sp\u00f4soby overovania k\u013e\u00fa\u010da hostite\u013ea pomocou z\u00e1znamov SSHFP v DNSSEC a certifik\u00e1tov hostite\u013ea (PKI). Tie\u017e je mo\u017en\u00e9 deaktivova\u0165 adapt\u00edvny v\u00fdber algoritmov hostite\u013esk\u00fdch k\u013e\u00fa\u010dov pomocou vo\u013eby HostKeyAlgorithms a pou\u017ei\u0165 mo\u017enos\u0165 UpdateHostKeys na z\u00edskanie \u010fal\u0161\u00edch k\u013e\u00fa\u010dov hostite\u013ea klientom po autentifik\u00e1cii.<\/p>\n

<\/a><\/noindex><\/p>\n

Zdroj: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 SSH-\u043a\u043b\u0438\u0435\u043d\u0442\u0430\u0445 OpenSSH \u0438 PuTTY \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2020-14002 \u0432 PuTTY \u0438 CVE-2020-14145 \u0432 OpenSSH), \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u0443\u0442\u0435\u0447\u043a\u0435 \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u0439 \u0432 \u0430\u043b\u0433\u043e\u0440\u0438\u0442\u043c\u0435 \u0441\u043e\u0433\u043b\u0430\u0441\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443, \u0441\u043f\u043e\u0441\u043e\u0431\u043d\u043e\u043c\u0443 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0438\u0442\u044c \u0442\u0440\u0430\u0444\u0438\u043a \u043a\u043b\u0438\u0435\u043d\u0442\u0430 (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043f\u0440\u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0447\u0435\u0440\u0435\u0437 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u0443\u044e \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u043c \u0442\u043e\u0447\u043a\u0443 \u0431\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430), \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u043f\u043e\u043f\u044b\u0442\u043a\u0443 \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u043a \u0445\u043e\u0441\u0442\u0443, \u043a\u043e\u0433\u0434\u0430 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u043c \u0435\u0449\u0451 \u043d\u0435 \u043f\u0440\u043e\u043a\u044d\u0448\u0438\u0440\u043e\u0432\u0430\u043d \u043a\u043b\u044e\u0447 \u0445\u043e\u0441\u0442\u0430. \u0417\u043d\u0430\u044f, \u0447\u0442\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-87197","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zranite\u013enos\u0165 v SSH klientoch OpenSSH a PuTTY | ProHoster","description":"V SSH klientoch OpenSSH a PuTTY","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimost-v-ssh-klientah-openssh-i-putty","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 SSH-\u043a\u043b\u0438\u0435\u043d\u0442\u0430\u0445 OpenSSH \u0438 PuTTY | ProHoster","og:description":"\u0412 SSH-\u043a\u043b\u0438\u0435\u043d\u0442\u0430\u0445 OpenSSH \u0438 PuTTY","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimost-v-ssh-klientah-openssh-i-putty","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-07-05T05:42:02+00:00","article:modified_time":"2020-07-05T05:42:02+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"87197","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 13:56:23","updated":"2022-10-07 22:11:57","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/87197","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=87197"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/87197\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=87197"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=87197"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=87197"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}