{"id":106630,"date":"2023-02-03T12:48:25","date_gmt":"2023-02-03T10:48:25","guid":{"rendered":"https:\/\/prohoster.info\/?p=106630"},"modified":"2023-02-03T21:50:37","modified_gmt":"2023-02-03T19:50:37","slug":"vypusk-openssh-9-2-s-ustraneniem-uyazvimosti-proyavlyayushhejsya-na-etape-do-autentifikaczii","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/vypusk-openssh-9-2-s-ustraneniem-uyazvimosti-proyavlyayushhejsya-na-etape-do-autentifikaczii","title":{"rendered":"L\u00ebshimi i OpenSSH 9.2 me rregullimin e ndjeshm\u00ebris\u00eb, q\u00eb shfaqet n\u00eb faz\u00ebn p\u00ebrpara autentifikimit","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
U publikua versioni i OpenSSH 9.2, implementimi i hapur i klientit dhe serverit p\u00ebr funksionimin me protokollet SSH 2.0 dhe SFTP. N\u00eb k\u00ebt\u00eb versions t\u00eb ri \u00ebsht\u00eb eliminuar nj\u00eb dob\u00ebsi q\u00eb shkakton l\u00ebshimin e dyfisht\u00eb t\u00eb kujtes\u00ebs n\u00eb faz\u00ebn para fillimit t\u00eb autentifikimit. Vet\u00ebm versioni OpenSSH 9.1 \u00ebsht\u00eb i preksh\u00ebm nga kjo dob\u00ebsi, nd\u00ebrsa n\u00eb versionet e m\u00ebparshme problemi nuk shfaqet. <\/p>\n
P\u00ebr t\u00eb krijuar kushte p\u00ebr shfaqjen e nj\u00eb vulnerabiliteti, mjafton t\u00eb ndryshoni bannerin e klientit SSH n\u00eb «SSH-2.0-FuTTYSH_9.1p1» p\u00ebr t\u00eb arritur caktimin e flamujve «SSH_BUG_CURVE25519PAD» dhe «SSH_OLD_DHGEX», t\u00eb cil\u00ebt varen nga versioni i klientit SSH. Pas caktimit t\u00eb k\u00ebtyre flamujve, memoria p\u00ebr tamponin «options.kex_algorithms» lirohet dy her\u00eb \u2014 gjat\u00eb ekzekutimit t\u00eb funksionit do_ssh2_kex(), q\u00eb th\u00ebrret compat_kex_proposal(), dhe gjat\u00eb ekzekutimit t\u00eb funksionit do_authentication2(), q\u00eb th\u00ebrret n\u00eb zinxhir input_userauth_request(), mm_getpwnamallow(), copy_set_server_options(), assemble_algorithms() dhe kex_assemble_names(). <\/p>\n
Krijimi i nj\u00eb eksploiti funksional p\u00ebr vulnerabilitetin konsiderohet i pak\u00ebt, pasi procesi i shfryt\u00ebzimit \u00ebsht\u00eb shum\u00eb i komplikuar \u2014 bibliotekat moderne t\u00eb shp\u00ebrndarjes s\u00eb memories ofrojn\u00eb mbrojtje nga lirimi i dyfisht\u00eb t\u00eb memories, dhe procesi pre-auth, n\u00eb t\u00eb cilin ndodhet gabimi, ekzekutohet me privilegje t\u00eb ulura n\u00eb nj\u00eb ambient t\u00eb izoluar sandbox. <\/p>\n
P\u00ebrve\u00e7 dob\u00ebsis\u00eb s\u00eb p\u00ebrmendur, n\u00eb k\u00ebt\u00eb version jan\u00eb eliminuar edhe dy probleme t\u00eb tjera t\u00eb siguris\u00eb: <\/p>\n
\n
Gabimi n\u00eb procesimin e konfigurimit «PermitRemoteOpen», q\u00eb \u00e7on n\u00eb injorimin e argumentit t\u00eb par\u00eb, n\u00ebse ai ndryshon nga vlerat «any» dhe «none». Problemi shfaqet n\u00eb versionet pas OpenSSH 8.7 dhe \u00e7on n\u00eb kalimin e verifikimit kur specifikohet vet\u00ebm nj\u00eb autorizim.\n
Nj\u00eb sulmues q\u00eb kontrollon serverin DNS t\u00eb p\u00ebrdorur p\u00ebr t\u00eb p\u00ebrcaktuar emrat, mund t\u00eb arrij\u00eb q\u00eb t\u00eb fut\u00eb simbole speciale (p.sh. «*») n\u00eb skedar\u00ebt known_hosts, n\u00ebse n\u00eb konfigurim aktivizohen opsionet CanonicalizeHostname dhe CanonicalizePermittedCNAMEs, dhe rezoluesi sistemor nuk verifikon sakt\u00ebsin\u00eb e p\u00ebrgjigjeve nga serveri DNS. Kryerja e sulmit konsiderohet e pamundur, pasi emrat e kthyera duhet t\u00eb p\u00ebrmbushin kushtet e caktuara p\u00ebrmes CanonicalizePermittedCNAMEs. <\/ul>\n
Ndryshime t\u00eb tjera: <\/p>\n
\n
N\u00eb ssh_config p\u00ebr SSH \u00ebsht\u00eb shtuar konfigurimi EnableEscapeCommandline, q\u00eb rregullon aktivizimin e p\u00ebrpunimit nga ana e klientit t\u00eb sekuencave t\u00eb ikjes «~C», duke ofruar nj\u00eb komand\u00eb. P\u00ebr default, p\u00ebrpunimi i «~C» tani \u00ebsht\u00eb \u00e7aktivizuar p\u00ebr t\u00eb p\u00ebrdorur nj\u00eb izolim m\u00eb t\u00eb rrept\u00eb sandbox, q\u00eb potencialisht mund t\u00eb \u00e7oj\u00eb n\u00eb d\u00ebmtimin e sistemeve ku «~C» p\u00ebrdoret p\u00ebr t\u00eb ridrejtuar porte gjat\u00eb funksionimit.\n
N\u00eb sshd_config p\u00ebr sshd \u00ebsht\u00eb shtuar drejtorja ChannelTimeout p\u00ebr t\u00eb caktuar koh\u00ebn e skadimit t\u00eb pasivitetit t\u00eb kanalit (kanalet, n\u00eb t\u00eb cilat p\u00ebr nj\u00eb koh\u00eb t\u00eb caktuar t\u00eb caktuar nga drejtorja nuk ka trafik t\u00eb regjistruar, do t\u00eb mbyllen automatikisht). P\u00ebr seanc\u00ebn, X11, agjentin dhe ridrejtimin e trafikut mund t\u00eb p\u00ebrcaktohen koh\u00ebzgjatje t\u00eb ndryshme t\u00eb skadimit.\n
N\u00eb sshd_config p\u00ebr sshd \u00ebsht\u00eb shtuar drejtorja UnusedConnectionTimeout, e cila lejon caktimin e nj\u00eb koh\u00ebzgjatje p\u00ebr p\u00ebrfundimin e lidhjeve t\u00eb klient\u00ebve, q\u00eb kan\u00eb qen\u00eb pa kanale aktive p\u00ebr nj\u00eb koh\u00eb t\u00eb caktuar.\n
N\u00eb sshd \u00ebsht\u00eb shtuar opsioni «-V» p\u00ebr t\u00eb treguar versionin n\u00eb ngjashm\u00ebri me opsionin e ngjash\u00ebm n\u00eb klientin SSH.\n
N\u00eb daljen e «ssh -G» \u00ebsht\u00eb shtuar rreshti «Host», q\u00eb reflekton vler\u00ebn e argumentit me emrin e hostit.\n
N\u00eb scp dhe sftp \u00ebsht\u00eb shtuar opsioni «-X» p\u00ebr t\u00eb menaxhuar parametra t\u00eb till\u00eb t\u00eb protokollit SFTP, si\u00e7 jan\u00eb madh\u00ebsia e tamponit t\u00eb kopjimit dhe numri i k\u00ebrkesave q\u00eb presin t\u00eb p\u00ebrfundojn\u00eb.\n